In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: au1000: move free_irq out of the close-time spinlocked section<\/p>\n
au1000_close() calls free_irq() while aup->lock is still held with
\nspin_lock_irqsave(). free_irq() can sleep because it takes the IRQ
\ndescriptor request mutex, so it does not belong inside the close-time
\nspinlocked section.<\/p>\n
This was found by our static analysis tool and then confirmed by manual
\nreview of the in-tree au1000_close() .ndo_stop path. The reviewed path
\nkeeps aup->lock held across the MAC reset, queue stop and
\nfree_irq(dev->irq, dev).<\/p>\n
A directed runtime validation kept that ndo_stop carrier and the same
\nfree_irq(dev->irq, dev) operation under the driver lock. Lockdep reported
\n“BUG: sleeping function called from invalid context” and “Invalid wait
\ncontext” while free_irq() was taking desc->request_mutex, with
\nau1000_close() and free_irq() on the stack.<\/p>\n
Drop aup->lock before freeing the IRQ. The protected close-time work still
\nstops the device and queue before IRQ teardown, but the sleepable IRQ core
\npath now runs outside the spinlocked section.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: au1000: move free_irq out of the close-time spinlocked section<\/p>\n
au1000_close() calls free_irq() while aup->lock is still held <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28630","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28630","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28630"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28630"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28630"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}