In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: use wq_has_sleeper() in release_in_xmit()<\/p>\n
release_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then
\nchecks waitqueue_active() to decide whether anyone needs waking.
\nclear_bit_unlock() is only a release operation: it orders the
\ncritical section before the bit clear, but does not order the
\nsubsequent plain load of the wait queue head after it. The waiter
\nside does the mirror image – it adds itself to the wait queue and
\nthen tests the bit. That is the classic store-buffering pattern: the
\nreleasing CPU can read the wait queue as empty while the waiting CPU
\nstill reads the bit as set, so the sleeper is never woken.<\/p>\n
The waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),
\nboth in uninterruptible wait_event() with no timeout. A lost wake-up
\nstrands the shutdown worker on its single-threaded workqueue until
\nsome other sender releases the bit again – and on a connection that
\nis being torn down precisely because it failed, there may never be
\nanother sender.<\/p>\n
The barrier used to be there: release_in_xmit() did clear_bit()
\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (“rds:
\nintroduce acquire\/release ordering in acquire\/release_in_xmit()”)
\nfolded both into clear_bit_unlock(), which strengthened the lock
\nhand-off but silently dropped the full barrier the wake-up check
\ndepends on. The refill counterpart, release_refill() in
\nnet\/rds\/ib_recv.c, still carries its smp_mb__after_atomic() for
\nexactly this reason.<\/p>\n
Use wq_has_sleeper(), which is waitqueue_active() preceded by the
\nrequired full barrier.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: use wq_has_sleeper() in release_in_xmit()<\/p>\n
release_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then
\nchecks wa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29227","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}