In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained<\/p>\n
hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
\nunconditionally. They can run from the L2CAP\/SCO\/ISO socket send path
\nwhile hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN
\nracing with a socket write). Since that queue_work() is not chained
\nwork from the tx_work worker itself, __queue_work() sees the queue
\nmarked __WQ_DRAINING, warns “cannot queue %ps on wq %s”, and drops
\nthe work:<\/p>\n
WARNING: CPU: 1 PID: 5985 at kernel\/workqueue.c:2352 __queue_work
\n Call Trace:
\n queue_work_on
\n l2cap_chan_send
\n l2cap_sock_sendmsg
\n …<\/p>\n
hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before
\ndraining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()
\ncheck it before queuing. Route the tx_work producers through the
\nsame guard via a shared hci_sched_tx() helper.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained<\/p>\n
hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev-><\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33366","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}