In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: size a connection’s path set by the transport it ends up with<\/p>\n
__rds_conn_create() computes npaths from the caller’s transport before
\nit decides whether a connection to one of the host’s own addresses is
\nto be handled by the loopback transport instead. That substitution is
\nwhat an RDS\/TCP socket sending to a local address gets, and after it
\nthe path init loop still runs for the TCP transport’s RDS_MPATH_WORKERS
\npaths and allocates an ordered workqueue for each, while
\nrds_loop_conn_alloc() only ever provides transport data for path 0.<\/p>\n
rds_conn_destroy() sizes its teardown from c_trans, by then the
\nloopback transport, so it visits path 0 only – and
\nrds_conn_path_destroy() would skip the other paths anyway, since it
\nreturns before destroy_workqueue() for a path without transport data.
\nkfree(c_path) then drops the last pointers to seven workqueues. That
\nrepeats for every such connection, on every netns teardown or module
\nunload, and every distinct local destination address is a separate
\nconnection.<\/p>\n
Recompute npaths once the transport is final, so that creation and
\ndestruction agree on the set of paths. The c_path array stays sized
\nfor the caller’s transport; the unused entries are freed with it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: size a connection’s path set by the transport it ends up with<\/p>\n
__rds_conn_create() computes npaths from the caller’s trans<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41032","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}