In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunvdc: unmap LDC cookies when the descriptor send fails<\/p>\n
__send_request() maps the request’s pages into the LDC channel’s map
\ntable (ldc_map_sg()), fills in the descriptor and marks it
\nVIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger().
\nWhen the trigger fails, the error path only prints a message: the
\ndescriptor stays READY and the cookies are never unmapped. The
\nmapping is normally released in vdc_end_one() when the peer completes
\nthe descriptor – but a descriptor whose doorbell was never sent will
\nnever complete, and since dr->prod is not advanced on failure, the
\nreset path (vdc_requeue_inflight(), which walks [cons, prod)) never
\nvisits it either. The map table entries are leaked permanently.<\/p>\n
Since commit a11f6ca9aef9 (“sunvdc: Do not spin in an infinite loop
\nwhen vio_ldc_send() returns EAGAIN”) trigger failures occur in
\npractice under load, so every resulting I\/O error also leaks one
\nrequest’s worth of entries from the fixed-size (8192 entries per
\nchannel) map table. Because the allocator hands out contiguous
\nranges, fragmentation makes large multi-segment requests fail first
\nas the table drains, until ldc_map_sg() fails permanently and the
\ndisk is dead until reboot.<\/p>\n
It also makes any retry-based recovery unusable: requeuing the
\nrequest on -EAGAIN remaps the pages on every attempt, overwriting
\ndesc->cookies and orphaning the previous mapping, so the table
\ndrains at the retry rate. This is the memory exhaustion observed
\nwhen the requeue approach was first tested in October 2025.<\/p>\n
Roll back on failure: unmap the cookies, mark the descriptor FREE
\nagain and clear the request entry. If the trigger failed with
\n-ENOTCONN, __vdc_tx_trigger() has already reset the port, which
\ntears down and reallocates both the dring and the LDC channel
\nincluding its map table – nothing to roll back, and the stale
\ndescriptor must not be touched.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunvdc: unmap LDC cookies when the descriptor send fails<\/p>\n
__send_request() maps the request’s pages into the LDC channel’s map
\ntabl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29108","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}