In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()<\/p>\n
rds_tcp_reset_callbacks() quiesces the transmit path by setting the
\npath state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to
\nbe sampled clear before swapping the underlying socket and calling
\nrds_send_path_reset().<\/p>\n
Sampling the bit clear is not the same as owning it: rds_send_xmit()
\ncan re-acquire RDS_IN_XMIT right after the wait_event() returns. Its
\nstate recheck after taking the lock is a store-buffering pattern (the
\nresetter writes the state and reads the bit, the sender writes the
\nbit and reads the state) and acquire_in_xmit() is only an acquire
\noperation, so on weakly ordered architectures both sides can miss
\neach other’s write and the transmit path then runs concurrently with
\nrds_send_path_reset() rewriting cp_xmit_* state – which is exactly
\nwhat the comment above rds_send_path_reset() tells its callers to
\nprevent.<\/p>\n
Take the lock instead, hold it across the socket swap and
\nrds_send_path_reset(), and release it with a wake-up at the end. The
\nlock-ordering constraint documented above the wait still holds: the
\nlock is acquired before lock_sock(), so a sender inside tcp_sendmsg()
\ncan never be waited on while we hold the socket lock.<\/p>\n
Two details of the old code go away with the same change:<\/p>\n
– t_sock is now read only after the lock is acquired. The old code
\n cached it before waiting; the teardown in rds_conn_shutdown()
\n releases that socket and clears t_sock, so a pointer cached before
\n the wait can be stale by the time the accept path resumes. Reading
\n it under RDS_IN_XMIT is what makes the exclusion complete once the
\n teardown owns the same lock, which the next patch arranges; until
\n then the teardown still only samples the bit, and the two paths
\n remain as exposed to each other as they are today.<\/p>\n
– The old !osock early path called rds_send_path_reset() with no
\n serialization at all. It now runs under the lock like the normal
\n path. The conditional RDS_CONN_RESETTING transition of the
\n previous patch happens before the socket check either way: a path
\n found without a socket is either still connecting (its reconnect
\n worker blocked on t_conn_path_lock) and legitimately goes
\n RESETTING -> UP on the new socket, or it has been torn down
\n meanwhile and is dropped.<\/p>\n
The in-function comment describing the old wait-based quiesce is
\nrewritten to describe the lock-based one, and the stale block comment
\nabove the function (which still described a return value and an
\nincomplete list of t_sock writers) is refreshed to name all four
\nwriters – the connect, accept, teardown and swap paths – and what
\nserializes each of them.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()<\/p>\n
rds_tcp_reset_callbacks() quiesces the transmit path by setting the
\npath<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29225","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}