In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virt: acrn: Fix irqfd use-after-free during eventfd shutdown<\/p>\n
acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
\nthe same struct hsm_irqfd:<\/p>\n
CPU0 CPU1
\n —- —-
\n eventfd_release()
\n wake_up_poll(EPOLLHUP)
\n hsm_irqfd_wakeup()
\n queue_work(&irqfd->shutdown)
\n acrn_irqfd_deassign()
\n hsm_irqfd_shutdown()
\n list_del_init()
\n eventfd_ctx_remove_wait_queue()
\n eventfd_ctx_put()
\n kfree(irqfd)
\n hsm_irqfd_shutdown_work()
\n container_of(work, …, shutdown)
\n irqfd->vm irqfds
\n under irqfds_lock and queue the cleanup work.
\n – hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the
\n eventfd waitqueue entry, drops the eventfd reference and frees the
\n irqfd.
\n – A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()
\n ensures the cleanup work is queued at most once, no matter how many
\n of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to
\n call from the waitqueue callback, which runs with wqh->lock held and
\n IRQs disabled and therefore cannot take irqfds_lock.
\n – acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the
\n eventfd is fully detached on return. acrn_irqfd_deinit() deactivates
\n every irqfd, flushes the workqueue and only then destroys it, so no
\n path can queue_work() onto a torn-down workqueue.
\n – acrn_irqfd_assign() now installs the eventfd waitqueue entry and
\n publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is
\n never visible to deassign\/deinit before its waitqueue entry is in
\n place, and any EPOLLHUP that fires in the assign window queues
\n cleanup work that blocks on irqfds_lock until publication is done.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virt: acrn: Fix irqfd use-after-free during eventfd shutdown<\/p>\n
acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and fr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28710","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}