In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: convert nfsd_net boolean flags to unsigned long flags word<\/p>\n
nfsd_net contains several boolean fields that are accessed from
\nconcurrent contexts without serialization. In particular,
\nnfsd4_end_grace() guards its drain path with a plain bool:<\/p>\n
if (nn->grace_ended)
\n return;
\n nn->grace_ended = true;<\/p>\n
The read and the write are independent, and nothing in struct
\nnfsd_net serializes them. At least two contexts can reach this
\ncode with no lock held:<\/p>\n
laundromat path
\n laundry_wq kworker
\n nfs4_laundromat()
\n nfsd4_end_grace()<\/p>\n
RECLAIM_COMPLETE path
\n nfsd compound kthread
\n nfsd4_reclaim_complete()
\n inc_reclaim_complete()
\n nfsd4_end_grace()<\/p>\n
Both callers can observe grace_ended == false on different CPUs,
\nboth store true, and both proceed into nfsd4_record_grace_done(),
\nwhich invokes the active client_tracking_ops->grace_done callback.
\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops
\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via
\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),
\nwhich walks every bucket of reclaim_str_hashtbl with no lock and
\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each
\nentry. Two concurrent walkers corrupt the list and double-free
\nevery nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()
\niterating the same bucket reads through freed memory.<\/p>\n
A third call site exists in nfs4_state_start_net() on the
\nskip_grace startup path, but it runs under nfsd_mutex before any
\nclient has connected and before the laundromat’s first delayed
\nwork fires, so it cannot race with the two callers above.<\/p>\n
Replace the scattered boolean fields in nfsd_net with a single
\nunsigned long flags word and an enum nfsd_net_flag for the bit
\npositions. The grace_ended race is fixed by using
\ntest_and_set_bit(), which is atomic on all architectures. The
\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,
\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to
\nuse test_bit\/set_bit\/clear_bit for consistency. This avoids
\nsub-word cmpxchg issues on architectures like Hexagon that only
\nsupport word-sized atomic operations.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: convert nfsd_net boolean flags to unsigned long flags word<\/p>\n
nfsd_net contains several boolean fields that are accessed from
\nc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}