In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/resctrl: Fix use-after-free during unmount<\/p>\n
During unmount or failure teardown all mon_data structures that contain
\nmonitoring event file private data are freed after which kernfs nodes are
\nremoved. However, the RDT_DELETED flag is never set for the statically
\nallocated default resource group.<\/p>\n
A concurrent reader of an event file associated with the default resource
\ngroup may, after dropping kernfs active protection, block on rdtgroup_mutex
\nwhile unmount proceeds to free the file private data and destroy the kernfs
\nnode without waiting for the reader.<\/p>\n
When the mutex is released, the reader wakes up, observes that RDT_DELETED
\nis not set for the default group, and dereferences the already-freed
\nfile private data.<\/p>\n
The scenario can be depicted as follows:
\n CPU0 CPU1
\n \/*
\n * Default resource group’s
\n * monitoring data accessible via
\n * kernfs file with kernfs_node::priv
\n * pointing to a struct mon_data.
\n * User opens the file for reading.
\n *\/
\n rdtgroup_mondata_show() \/* arch encounters fatal error *\/
\n rdtgroup_kn_lock_live() resctrl_exit()
\n atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock()
\n kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex)
\n cpus_read_lock() resctrl_fs_teardown()
\n mutex_lock(&rdtgroup_mutex) rmdir_all_sub()
\n mon_put_kn_priv()
\n \/* Delete all mon_data structures *\/
\n rdtgroup_destroy_root()
\n kernfs_destroy_root()
\n rdtgroup_default.kn = NULL
\n mutex_unlock(&rdtgroup_mutex)
\n \/*
\n * rdtgroup_default.flags is empty so
\n * rdtgroup_kn_lock_live() returns
\n * &rdtgroup_default
\n *\/
\n md = of->kn->priv;<\/p>\n
\/* md points to freed mon_data *\/<\/p>\n
Set RDT_DELETED for the default group unconditionally since the flag does
\nnot lead to the freeing of this statically allocated group.<\/p>\n
Do not allow a new resctrl mount if there are any waiters on default group
\nof previous mount. A new mount will re-initialize the default group that
\nwould appear to waiters from previous mount as though the default group is
\naccessible causing them to access the mon_data structures from the previous
\nmount that have been removed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/resctrl: Fix use-after-free during unmount<\/p>\n
During unmount or failure teardown all mon_data structures that contain
\nmonitoring e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6761","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}