In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/mlx5e: Fix HV VHCA stats agent registration race<\/p>\n
mlx5e_hv_vhca_stats_create() registers the stats agent through
\nmlx5_hv_vhca_agent_create(). The helper publishes the agent in
\nhv_vhca->agents[type] under agents_lock and immediately schedules an
\nasynchronous control invalidation on the HV VHCA workqueue before
\nreturning to mlx5e.<\/p>\n
The asynchronous invalidation invokes the control agent’s invalidate
\ncallback, which reads the hypervisor control block and forwards the
\ncommand to mlx5e_hv_vhca_stats_control(). That callback may either:<\/p>\n
– call cancel_delayed_work_sync(&priv->stats_agent.work), or
\n – call queue_delayed_work(priv->wq, &sagent->work, sagent->delay).<\/p>\n
However, the delayed_work and priv->stats_agent.agent are only
\ninitialized after mlx5_hv_vhca_agent_create() returns to mlx5e:<\/p>\n
agent = mlx5_hv_vhca_agent_create(…); \/* publish + invalidate *\/
\n …
\n priv->stats_agent.agent = agent; \/* too late *\/
\n INIT_DELAYED_WORK(&priv->stats_agent.work, …); \/* too late *\/<\/p>\n
If the asynchronous control path runs before the two assignments
\nabove, it can:<\/p>\n
– Operate on an uninitialized delayed_work whose timer.function is
\n NULL. queue_delayed_work() calls add_timer() unconditionally, so
\n when the timer expires the timer softirq invokes a NULL function
\n pointer.
\n – Re-initialize the timer later through INIT_DELAYED_WORK() while
\n the timer is already enqueued in the timer wheel, corrupting the
\n hlist (entry.pprev cleared while the previous bucket node still
\n points at this entry).
\n – When the worker eventually runs, mlx5e_hv_vhca_stats_work() reads
\n sagent->agent (NULL) and dereferences it inside
\n mlx5_hv_vhca_agent_write().<\/p>\n
Fix this by:<\/p>\n
– Initializing priv->stats_agent.work before invoking
\n mlx5_hv_vhca_agent_create(), so the work is always in a valid
\n state when the control callback observes it.
\n – Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter
\n to mlx5_hv_vhca_agent_create(). The helper writes the agent
\n pointer to *ctx_update before publishing into hv_vhca->agents[]
\n and triggering the agents_update flow, so any callback
\n subsequently invoked from that flow already sees a valid
\n priv->stats_agent.agent. This avoids having the control
\n callback participate in agent initialization.<\/p>\n
While at it, access priv->stats_agent.agent with
\nREAD_ONCE()\/WRITE_ONCE() for the cross-CPU access with the worker, and
\nclear priv->stats_agent.buf on the agent_create() failure path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/mlx5e: Fix HV VHCA stats agent registration race<\/p>\n
mlx5e_hv_vhca_stats_create() registers the stats agent through
\nmlx5_hv_vhca_a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6969","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}