In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Decouple req recycling from RPC completion<\/p>\n
rl_kref formerly served two distinct lifetimes through a single
\nrefcount: it gated when a Reply could wake its RPC task, and it
\ngated when an rpcrdma_req could return to its free pool. The
\nmarshal path took the Send-side reference only when SGEs needed
\nDMA-unmap (sc_unmap_count > 0), which made a Send carrying only
\npre-registered buffers an exception: the Reply handler dropped
\nrl_kref from 1 to 0 and freed the req while the HCA might still
\nbe DMA-reading from its send buffer.<\/p>\n
Give rl_kref a narrower job. The RPC layer takes one reference
\nwhen slot allocation hands a req out. rpcrdma_prepare_send_sges()
\ntakes a Send-side reference unconditionally after WR preparation
\nsucceeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop
\nthe RPC-layer reference; rpcrdma_sendctx_unmap() drops the
\nSend-side reference. The req returns to its free pool only after
\nboth owners have signed off.<\/p>\n
The existing kref_init(&req->rl_kref) call in
\nrpcrdma_prepare_send_sges() is removed. Initialization moves to
\nthe slot-allocation paths (xprt_rdma_alloc_slot and
\nrpcrdma_bc_rqst_get), and the release callback re-arms rl_kref
\nbefore the req returns to a free pool. A re-init in the marshal
\npath would discard the RPC-layer reference that already exists
\non entry.<\/p>\n
Three invariants follow:<\/p>\n
– Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.
\n xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the
\n backlog-wake branch in xprt_rdma_alloc_slot() each kref_init
\n rl_kref before publishing the req. Without this invariant,
\n an RPC task that aborts between slot allocation and marshal
\n (gss_refresh failure or signal during call_connect, for
\n example) would drive xprt_release() ->
\n xprt_rdma_free_slot() -> kref_put against a refcount of
\n zero, saturating refcount_t and stranding the slot.<\/p>\n
– The Send-side reference is taken only after WR prep
\n succeeds. A mapping failure in rpcrdma_prepare_send_sges()
\n runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx
\n and clears sc_req without touching rl_kref. The sendctx
\n ring walks in rpcrdma_sendctx_put_locked() and
\n rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,
\n so a burst of -EIO marshal failures cannot hold reqs off
\n rb_send_bufs.<\/p>\n
– The release callback re-arms rl_kref so the next consumer
\n enters with the invariant satisfied.<\/p>\n
Replies now complete the RPC directly. rpcrdma_reply_handler()
\ncalls rpcrdma_complete_rqst() in place of kref_put on the
\nnon-LocalInv branch. The LocalInv branch already completes the
\nRPC from frwr_unmap_async() and is unaffected.<\/p>\n
Because Send-side references can now outlive RPC completion,
\nconnection teardown drains sendctx entries whose unsignaled
\nSends never had a later signaled completion to walk the ring.
\nrpcrdma_sendctxs_destroy() walks the active range and runs
\nrpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req
\nbefore the request buffers are reset, and is moved ahead of
\nrpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs
\nare still in their pre-reset state when the Send-side refs are
\nreleased.<\/p>\n
The drain creates a teardown-ordering hazard on the backchannel
\npath. With the new lifetime, releasing a bc_prealloc req from
\nrpcrdma_req_release() re-adds it to bc_pa_list. The disconnect
\nin xprt_rdma_destroy() runs after xprt_destroy_backchannel() has
\nalready emptied bc_pa_list, so the drained reqs would otherwise
\nleak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)
\na second time after the disconnect to reclaim them.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Decouple req recycling from RPC completion<\/p>\n
rl_kref formerly served two distinct lifetimes through a single
\nrefcount: it <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7143","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}