In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix use-after-free freeing trigger private data<\/p>\n
Commit 61d445af0a7c (“tracing: Add bulk garbage collection of freeing
\nevent_trigger_data”) moved the kfree() of event_trigger_data to a kthread
\nthat runs tracepoint_synchronize_unregister() before freeing. That removed
\nthe synchronization the trigger .free callbacks used to get implicitly and
\ninline from trigger_data_free().<\/p>\n
event_hist_trigger_free(), event_hist_trigger_named_free() and
\nevent_enable_trigger_free() free their satellite data (hist_data, cmd_ops,
\nenable_data) right after trigger_data_free() returns. With the
\nsynchronization now deferred to the kthread, a concurrent tracepoint
\nhandler can still reach that data through the list_del_rcu()’d trigger,
\ncausing a use-after-free.<\/p>\n
The histogram teardown must stay synchronous: remove_hist_vars() and
\nunregister_field_var_hists() have to detach a synthetic event from the
\nhistogram before the trigger-removal write returns, otherwise a following
\ncommand races in and the synthetic-event removal fails with -EBUSY, as the
\ntrigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait
\nwith the correct barrier – tracepoint_synchronize_unregister(), matching
\nthe free kthread – before freeing.<\/p>\n
The enable trigger has no such synchronous requirement, and a blocking
\nsynchronize there would re-serialize the path that commit deliberately
\ndeferred. Give it an optional private_data_free() callback that the free
\nkthread runs after its grace period, and free enable_data from there.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix use-after-free freeing trigger private data<\/p>\n
Commit 61d445af0a7c (“tracing: Add bulk garbage collection of freeing
\neve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5408","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}