In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
configfs: pin the symlink target’s dirent instead of chasing ->ci_dentry<\/p>\n
create_link() reads the target’s configfs_dirent from
\nitem->ci_dentry->d_fsdata, relying on the item reference taken by
\nget_target(). That reference pins the item, not its dentry: the dentry is
\npinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via
\nsimple_rmdir() while the item is still alive. A symlink racing with rmdir
\nof its target can therefore find ->ci_dentry freed and its dirent
\nreleased, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().<\/p>\n
Take the dirent in get_target() as well, under ->d_lock and atomically
\nwith the item reference, and pass it down to create_link(). A hashed
\ndentry has not been killed yet, so its ->d_fsdata reference keeps the
\ndirent alive there.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
configfs: pin the symlink target’s dirent instead of chasing ->ci_dentry<\/p>\n
create_link() reads the target’s configfs_dirent from
\nite<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29106","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}