In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/siw: Clear association under lock if siw_qp_modify fails in siw_accept<\/p>\n
We need to clear cep before release state_lock as siw_qp_llp_close and
\nsiw_qp_modify->siw_qp_llp_close did.<\/p>\n
Otherwise if siw_qp_modify() fails in siw_accept(), the QP’s state_lock
\nis released before the error path cleanup. A concurrent ibv_modify_qp()
\ntransitioning the QP to ERROR can race in this window:<\/p>\n
siw_accept() ibv_modify_qp(ERROR)
\n ———————- ———————-
\n siw_qp_modify() fails
\n up_write(&qp->state_lock)
\n down_write(&qp->state_lock)
\n nextstate_from_idle():
\n\t\t\t\t if (qp->cep)
\n siw_cep_put(qp->cep) cep = NULL
\n goto error
\n cep->qp = NULL cep and drop the association reference taken by siw_cep_get(),
\nall under the write lock held from the initial down_write(&qp->state_lock).
\nThread B therefore sees qp->cep == NULL, skips its own put, and cannot free
\nthe cep before siw_accept() is done with it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/siw: Clear association under lock if siw_qp_modify fails in siw_accept<\/p>\n
We need to clear cep before release state_lock as siw_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33436","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}