In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/rw: end write accounting from ->ki_complete<\/p>\n
Commit b000145e9907 moved both the fsnotify calls and the write
\naccounting out of the kiocb completion handler and into the
\nio_req_rw_complete() task_work. However, only the fsnotify part actually
\nneeded to move as it may sleep. Ending the write accounting is just a
\npercpu_up_read() on the superblock writers sem.<\/p>\n
Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE
\nprotection depend on the ring owner getting to running task_work. But
\nthe task may be blocked in freeze_super(), causing it to never get to
\nthat:<\/p>\n
task io-wq worker
\n ————————————————————–
\n io_write()
\n io_kiocb_start_write() (takes sb_writers, hidden from
\n lockdep by __sb_writers_release)
\n write_iter() -> -EIOCBQUEUED
\n ioctl(FS_IOC_SHUTDOWN)
\n bdev_freeze()
\n freeze_super()
\n percpu_down_write() <- waits for the reader above
\n io_write()
\n kiocb_start_write()
\n percpu_down_read() <- queued
\n behind the
\n writer<\/p>\n
io_complete_rw()
\n queues io_req_rw_complete() <- never runs, task is in D state<\/p>\n
End the write from io_complete_rw() instead, and leave only the fsnotify
\ncalls in task_work.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/rw: end write accounting from ->ki_complete<\/p>\n
Commit b000145e9907 moved both the fsnotify calls and the write
\naccounting ou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29051","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}