In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: clear cp_flags bits individually in rds_conn_path_reset()<\/p>\n
rds_conn_path_reset() wipes the whole flag word with a plain
\ncp->cp_flags = 0 store. Every other accessor of that word uses
\natomic bitops, and some of them can run concurrently with the reset:
\nRDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the
\ntransport completion paths, neither of which holds anything that
\nexcludes the shutdown worker. A plain store racing an atomic
\nread-modify-write on the same word is a data race, and whichever
\nside loses has its update silently discarded.<\/p>\n
Clear the two bits the reset is actually responsible for instead.
\nRDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they
\nbelong to the caller, rds_conn_shutdown(), which waits for both to be
\nclear before calling the transport shutdown and this reset.<\/p>\n
This also gives every bit in cp_flags a single well-defined writer
\ndiscipline, which the following patches rely on when they turn
\nRDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the
\nteardown: a blanket store mid-teardown would destroy lock ownership
\nthat an atomic clear preserves.<\/p>\n
Oracle UEK carries the same conversion (“net\/rds: Preserve essential
\nconnection state flags”), motivated by its asynchronous shutdown
\nstate machine, whose progress and destroy flags must survive the
\nreset. UEK’s variant also clears RDS_IN_XMIT and RDS_RECV_REFILL
\nbecause there the reset runs as the final step of a teardown that
\nowns both bits, making those clears its unlock. Upstream that
\nrelease belongs in rds_conn_shutdown(): once a later patch in this
\nseries turns the two bits into locks held across the teardown, ending
\nownership needs release semantics and a wake-up that a plain clear
\ninside the reset would not provide.<\/p>\n
Based on Oracle UEK commit “net\/rds: Preserve essential connection
\nstate flags” by Gerd Rausch.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: clear cp_flags bits individually in rds_conn_path_reset()<\/p>\n
rds_conn_path_reset() wipes the whole flag word with a plain
\ncp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29226","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}