In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_input: stop callbacks before unregistering input device<\/p>\n
virtinput_remove() unregisters the input device before resetting the
\nvirtio device. virtinput_recv_events() drops vi->lock around input_event(),
\nso clearing vi->ready does not stop a callback that passed the entry check.
\nIt can still use vi->idev, requeue buffers and kick the queue.<\/p>\n
Reset first, as virtinput_freeze() already does. With the preceding core
\nchange, reset waits for callbacks before input_unregister_device() can
\nfree vi->idev. Recheck vi->ready after taking the lock again: keep draining
\ncompleted events so an input packet is not truncated, but stop requeueing
\nbuffers and kicking the queue.<\/p>\n
With evdev attached, input_unregister_handle() currently waits for an RCU
\ngrace period, which also waits out IRQ callbacks. This masks the lifetime
\nbug on PCI and MMIO, but does not protect sleepable callbacks on other
\ntransports.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_input: stop callbacks before unregistering input device<\/p>\n
virtinput_remove() unregisters the input device before resetting th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29142","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}