In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry<\/p>\n
The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()
\nis missing a read memory barrier (smp_rmb) before its second counter
\ncheck. The standard kernel read_seqcount_retry() includes smp_rmb()
\nto ensure that all data reads complete before the counter is re-checked.<\/p>\n
Without this barrier, on weakly-ordered architectures (ARM, POWER),
\nthe CPU may reorder field reads past the second counter check, making
\nthe retry logic ineffective: it could observe a consistent counter pair
\nwhile reading fields that have been concurrently modified by the writer.<\/p>\n
Add smp_rmb() before the second counter check to order the field reads
\nahead of it, matching the barrier semantics of the standard seqcount
\nread-side. The begin-side smp_load_acquire() already pairs with the
\nsmp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering
\nthe field reads, the retry check no longer needs acquire semantics and
\nreads the counter with a plain READ_ONCE(), as read_seqcount_retry()
\ndoes.<\/p>\n
[ cel: Use READ_ONCE instead of smp_load_acquire() ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry<\/p>\n
The hand-rolled seqcount-like protocol in nfsd_nl_rpc_statu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28493","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}