In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-vdpa: protect config_ctx from being freed under the config callback<\/p>\n
vhost_vdpa_config_cb() loads v->config_ctx and signals it without taking
\na reference and without holding any lock:<\/p>\n
\tstruct eventfd_ctx *config_ctx = v->config_ctx;<\/p>\n
\tif (config_ctx)
\n\t\teventfd_signal(config_ctx);<\/p>\n
VHOST_VDPA_SET_CONFIG_CALL replaces that field and drops what is normally
\nthe last reference to the old context:<\/p>\n
\tswap(ctx, v->config_ctx);<\/p>\n
\tif (ctx)
\n\t\teventfd_ctx_put(ctx);<\/p>\n
eventfd_ctx_put() drops the last kref and frees the context immediately,
\nwith no RCU grace period, so a callback that has already loaded the
\npointer goes on to dereference freed memory. The two sides share no
\nlock: the ioctl runs under vhost_dev.mutex, while the parent invokes the
\ncallback from its own interrupt or workqueue context.<\/p>\n
This is not the reopen refcount underflow fixed by commit f6bbf0010ba0
\n(“vhost-vdpa: fix use-after-free of v->config_ctx”), which was about
\nvhost_vdpa_config_put() leaving a stale pointer behind. Here the pointer
\nis maintained correctly and it is the read side that is unprotected.<\/p>\n
With VDUSE as the parent this is reachable from userspace with access to
\n\/dev\/vduse (root by default). VDUSE_DEV_INJECT_CONFIG_IRQ queues
\ndev->inject, and vduse_dev_irq_inject() runs the callback under VDUSE’s
\nown dev->irq_lock, which vhost does not hold. vduse_dev_reset() does
\nflush_work(&dev->inject), but VHOST_VDPA_SET_CONFIG_CALL never goes
\nthrough reset, so an inject already in flight is not waited for. A
\nprocess that injects config interrupts on the VDUSE fd while another
\nthread swaps the call fd on the vhost-vdpa fd hits it in seconds:<\/p>\n
BUG: KASAN: slab-use-after-free in native_queued_spin_lock_slowpath
\n Read of size 4 at addr ffff888107d21808 by task kworker\/u17:1\/2993
\n Workqueue: vduse-irq vduse_dev_irq_inject
\n Call Trace:
\n native_queued_spin_lock_slowpath+0x97\/0x5b0
\n _raw_spin_lock_irqsave+0xd4\/0xe0
\n eventfd_signal_mask+0x69\/0x120
\n vhost_vdpa_config_cb+0x34\/0x50
\n vduse_dev_irq_inject+0x46\/0x60
\n process_one_work+0x468\/0x950<\/p>\n
Allocated by task 2992:
\n do_eventfd+0x50\/0x200
\n __x64_sys_eventfd2+0x2e\/0x40<\/p>\n
Freed by task 2992:
\n eventfd_ctx_put+0xb9\/0xc0
\n vhost_vdpa_unlocked_ioctl+0x116c\/0x2190<\/p>\n
Add a spinlock covering every access to config_ctx, so the callback
\neither signals a context that is still alive or observes NULL, and the
\nput happens only once no callback can reach the old value.<\/p>\n
Clearing the parent’s callback before the put would not be enough: of the
\nin-tree set_config_cb() implementations only VDUSE takes a lock, the rest
\nstore the pointer unlocked, so that would not order against an in-flight
\ninvocation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-vdpa: protect config_ctx from being freed under the config callback<\/p>\n
vhost_vdpa_config_cb() loads v->config_ctx and signals i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29148","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}