In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-vdpa: don’t install the eventfd_ctx_fdget() error in config_ctx<\/p>\n
vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value
\ninto v->config_ctx before checking it, so on failure the field briefly
\nholds an ERR_PTR:<\/p>\n
\tctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd);
\n\tswap(ctx, v->config_ctx);<\/p>\n
\tif (!IS_ERR_OR_NULL(ctx))
\n\t\teventfd_ctx_put(ctx);<\/p>\n
\tif (IS_ERR(v->config_ctx)) {
\n\t\tlong ret = PTR_ERR(v->config_ctx);<\/p>\n
\t\tv->config_ctx = NULL;
\n\t\treturn ret;
\n\t}<\/p>\n
Commit 0bde59c1723a (“vhost-vdpa: set v->config_ctx to NULL if
\neventfd_ctx_fdget() fails”) added that clearing, and spelled out the
\ninvariant the rest of the file relies on: “we consider ‘v->config_ctx’
\nvalid if it is not NULL”. The window between the swap and the clearing
\nstill breaks it. vhost_vdpa_config_cb() only tests for NULL, so a config
\ninterrupt delivered inside the window hands the ERR_PTR to
\neventfd_signal().<\/p>\n
Check the fd before installing it instead. That closes the window and
\nmatches how vhost_vring_ioctl() handles the same failure for the vq call
\nfd.<\/p>\n
It also stops a rejected fd from tearing down a config interrupt that was
\nworking: until now the swap replaced the live context and put it, so
\nafter an EBADF the device silently stopped delivering config interrupts
\nuntil userspace installed a new fd.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-vdpa: don’t install the eventfd_ctx_fdget() error in config_ctx<\/p>\n
vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() r<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29149","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}