In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Fix unmatched rn_unregister on failed accept<\/p>\n
When svc_rdma_accept() takes the errout path before
\nrpcrdma_rn_register() has succeeded, the existing cleanup block
\ncalls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally.
\nsvcxprt_rdma is kzalloc’d, so on that path sc_rn.rn_index is 0 and
\nsc_rn.rn_done is NULL; the unregister therefore xa_erase()s another
\ncaller’s slot 0 and performs an unmatched kref_put() on the
\nrpcrdma_device’s rd_kref.<\/p>\n
The same errout also brackets the cleanup with svc_xprt_get()\/
\nsvc_xprt_put() around the kref_init() birth reference. The kref
\ngoes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the
\nnet\/ns_tracker it pinned) is leaked on every failed accept.<\/p>\n
rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc()
\nand kref_get() have both succeeded, so rn_done == NULL is a natural
\n“never registered” sentinel. Guard rpcrdma_rn_unregister() with an
\nearly return when rn_done is NULL, and clear rn_done before the
\nmatching xa_erase() so a repeated unregister is also a no-op.<\/p>\n
With that guard in place, the accept errout drops the kref_init()
\nbirth reference via svc_xprt_put(), which dispatches svc_rdma_free().
\nTeardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing
\nIS_ERR\/NULL guards in svc_rdma_free(); sc_rn is covered by the new
\nrn_done sentinel; sc_cm_id is non-NULL on every errout path because
\nsvc_rdma_accept() dereferences it above the first goto errout.<\/p>\n
svc_xprt_free() drops the module reference associated with the freed
\ntransport, and svc_handle_xprt() drops its pre-acquired reference
\nwhen ->xpo_accept() returns NULL. Take a replacement module reference
\nbefore svc_xprt_put() so the two module_put()s remain balanced.<\/p>\n
The rn_done guard also covers svc_rdma_free()’s non-listener call
\nto rpcrdma_rn_unregister() for transports whose register attempt
\nfailed or never ran.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Fix unmatched rn_unregister on failed accept<\/p>\n
When svc_rdma_accept() takes the errout path before
\nrpcrdma_rn_register() ha<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28488","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}