In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: watchdog: fix refcount tracking races<\/p>\n
Blamed commit converted the untracked dev_hold()\/dev_put() calls
\nin the watchdog code to use the tracked dev_hold_track()\/dev_put_track()
\n(which were later renamed\/interfaced to netdev_hold() and netdev_put()).<\/p>\n
By introducing dev->watchdog_dev_tracker to store the
\nreference tracking information without adding synchronization
\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the
\nrace condition where this pointer could be overwritten or freed
\nconcurrently, leading to the list corruption crash syzbot reported:<\/p>\n
list_del corruption, ffff888114a18c00->next is NULL
\n kernel BUG at lib\/list_debug.c:52 !
\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI
\nCPU: 1 UID: 0 PID: 91 Comm: kworker\/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)
\nHardware name: Google Google Compute Engine\/Google Compute Engine, BIOS Google 05\/09\/2026
\nWorkqueue: events_unbound linkwatch_event
\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22\/0x2a lib\/list_debug.c:52
\nCall Trace:<\/p>\n
__list_del_entry_valid include\/linux\/list.h:132 [inline]
\n __list_del_entry include\/linux\/list.h:246 [inline]
\n list_move_tail include\/linux\/list.h:341 [inline]
\n ref_tracker_free+0x1a7\/0x6c0 lib\/ref_tracker.c:329
\n netdev_tracker_free include\/linux\/netdevice.h:4491 [inline]
\n netdev_put include\/linux\/netdevice.h:4508 [inline]
\n netdev_put include\/linux\/netdevice.h:4504 [inline]
\n netdev_watchdog_down net\/sched\/sch_generic.c:600 [inline]
\n dev_deactivate_many+0x28c\/0xfe0 net\/sched\/sch_generic.c:1363
\n dev_deactivate+0x109\/0x1d0 net\/sched\/sch_generic.c:1397
\n linkwatch_do_dev net\/core\/link_watch.c:184 [inline]
\n linkwatch_do_dev+0xd3\/0x120 net\/core\/link_watch.c:166
\n __linkwatch_run_queue+0x3a5\/0x810 net\/core\/link_watch.c:240
\n linkwatch_event+0x8f\/0xc0 net\/core\/link_watch.c:314
\n process_one_work+0xa0e\/0x1980 kernel\/workqueue.c:3314
\n process_scheduled_works kernel\/workqueue.c:3397 [inline]
\n worker_thread+0x5ef\/0xe50 kernel\/workqueue.c:3478
\n kthread+0x370\/0x450 kernel\/kthread.c:436
\n ret_from_fork+0x69a\/0xc80 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n
This patch has three coordinated parts:<\/p>\n
1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.<\/p>\n
2) Remove netdev_watchdog_up() call from netif_carrier_on():
\n This ensures netdev_watchdog_up() is only called from process\/BH context
\n (via linkwatch workqueue dev_activate()), allowing us to use
\n spin_lock_bh() for synchronization.<\/p>\n
3) Synchronize watchdog up and watchdog timer:
\n Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.
\n Only allocate a new tracker in netdev_watchdog_up() if one is
\n not already present.
\n In dev_watchdog(), ensure we don’t release the tracker if the
\n timer was rescheduled either by dev_watchdog() itself or concurrently
\n by netdev_watchdog_up().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: watchdog: fix refcount tracking races<\/p>\n
Blamed commit converted the untracked dev_hold()\/dev_put() calls
\nin the watchdog code t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7198","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}