In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost\/net: complete zerocopy ubufs only once<\/p>\n
vhost-net initializes one ubuf_info per outstanding zerocopy TX
\ndescriptor and hands it to the backend socket. The networking stack may
\nthen clone a zerocopy skb before all skb references are released. For
\nexample, batman-adv fragmentation reaches skb_split(), which calls
\nskb_zerocopy_clone() and increments the same ubuf_info refcount.<\/p>\n
vhost_zerocopy_complete() currently treats every ubuf callback as a
\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the
\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when
\nthe callback only releases a cloned skb reference. A backend reset can
\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned
\nskb still carries the same ubuf_info. A later completion then
\ndereferences the freed ubufs pointer.<\/p>\n
KASAN reports the stale completion as:<\/p>\n
BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7\/0x1f0
\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101\/0x1f0
\n vhost_zerocopy_complete
\n skb_copy_ubufs
\n __dev_forward_skb2
\n veth_xmit<\/p>\n
The freed object was allocated from vhost_net_ioctl() while setting the
\nbackend and freed through kfree_rcu()\/kvfree_rcu_bulk after backend
\nremoval, while delayed skb completion still reached
\nvhost_zerocopy_complete().<\/p>\n
Honor the generic ubuf_info refcount before touching vhost state, and run
\nthe vhost descriptor completion only for the final ubuf reference. This
\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy
\nskbs.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost\/net: complete zerocopy ubufs only once<\/p>\n
vhost-net initializes one ubuf_info per outstanding zerocopy TX
\ndescriptor and hands <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7252","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}