In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/9p: fix race condition on rdma->state in trans_rdma.c<\/p>\n
The rdma->state field is modified without holding req_lock in both
\nrecv_done() and p9_cm_event_handler(), while rdma_request() accesses
\nthe same field under the req_lock spinlock. This inconsistent locking
\ncreates a race condition:<\/p>\n
– recv_done() running in softirq completion context sets
\n rdma->state = P9_RDMA_FLUSHING without acquiring req_lock<\/p>\n
– p9_cm_event_handler() modifies rdma->state at multiple points
\n (ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without
\n req_lock<\/p>\n
– rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to
\n protect the read-modify-write of rdma->state<\/p>\n
The race can cause lost state transitions: recv_done() or the CM
\nevent handler could set state to FLUSHING\/CLOSED while rdma_request()
\nis concurrently checking or modifying state under the lock, leading to
\nthe FLUSHING transition being silently overwritten by CLOSING. This
\ncorrupts the connection state machine and can cause use-after-free on
\nRDMA request objects during teardown.<\/p>\n
Fix by adding req_lock protection to all rdma->state modifications in
\nrecv_done() and p9_cm_event_handler(), matching the pattern already
\nused in rdma_request(). Use spin_lock_irqsave\/spin_unlock_irqrestore
\nin the CM event handler since it can race with recv_done() which runs
\nin softirq context.<\/p>\n
Tested with a kernel module that races two threads (simulating
\nrdma_request and recv_done\/CM handler) on rdma->state with proper
\nlocking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost
\ntransitions.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/9p: fix race condition on rdma->state in trans_rdma.c<\/p>\n
The rdma->state field is modified without holding req_lock in both
\nrecv_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7164","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}