In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/slab: take n->list_lock in __slab_try_return_freelist() to avoid race<\/p>\n
Commit ba7425312607 (“mm, slab: add an optimistic
\n__slab_try_return_freelist()”) incorrectly assumed that nobody has freed
\nan object to the slab as long as slab->freelist is NULL and cmpxchg
\nsucceeds.<\/p>\n
However, as reported by Hyunwoo Kim [1], other CPUs might have freed
\nan object to the slab, insert the slab to the partial list, then
\nallocated an object from the slab, and be in the middle of removing
\nthe slab from the list under n->list_lock.<\/p>\n
Since __refill_objects_node() puts the slab back on pc.slabs
\noutside n->list_lock, it might insert the slab into that list while
\nthe slab is concurrently being removed from n->partial.
\nThis led to a list corruption [1]:<\/p>\n
list_add corruption. next->prev should be prev
\n (ffff888100000248), but was dead000000000122.
\n (next=ffffea000416e410).
\n kernel BUG at lib\/list_debug.c:29!
\n Oops: invalid opcode: 0000 [#1] SMP NOPTI
\n CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted
\n 7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)
\n RIP: 0010:__list_add_valid_or_report+0x80\/0xd0
\n …
\n Call Trace:
\n alloc_from_new_slab+0x183\/0x300
\n ___slab_alloc+0x31c\/0x890
\n __kmalloc_noprof+0x3d4\/0x800
\n lsm_blob_alloc+0x2d\/0x50
\n security_msg_msg_alloc+0x26\/0x90
\n load_msg+0x1aa\/0x210
\n do_msgsnd+0x91\/0x800
\n do_syscall_64+0x109\/0x5d0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n …
\n Kernel panic – not syncing: Fatal exception<\/p>\n
This is a classic ABA problem where cmpxchg succeeds but the state has
\nchanged since __refill_objects_node() took the freelist from the slab.<\/p>\n
As Vlastimil Babka mentioned [2], it should be rare to return more than
\none slab (due to the racy read of slab->counters in
\nget_partial_node_bulk()). Therefore, instead of introducing additional
\ncomplexity, acquire and release n->list_lock twice in the worst case.<\/p>\n
Return the slab directly to the partial list and hold n->list_lock
\nacross the cmpxchg and add_partial(). This is similar to the initial
\nversion of commit ba7425312607 [3]. This is enough to avoid the race as
\nthe list manipulation is serialized by n->list_lock. While at it,
\nbring back unlikely() hint now that the condition is unlikely.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/slab: take n->list_lock in __slab_try_return_freelist() to avoid race<\/p>\n
Commit ba7425312607 (“mm, slab: add an optimistic
\n__slab_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29097","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}