In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()<\/p>\n
In the beginning of the loop, we try to obtain a locked delayed ref head,
\nif ‘locked_ref’ is currently NULL, by calling btrfs_select_ref_head(),
\nwhich can return an error pointer. If the error pointer is -EAGAIN we do
\na continue and go back to the beginning of the loop, which will not try
\nagain to call btrfs_select_ref_head() since ‘locked_ref’ is no longer
\nNULL but it’s ERR_PTR(-EAGAIN), and then we do:<\/p>\n
spin_lock(&locked_ref->lock);<\/p>\n
against a ERR_PTR(-EAGAIN) value, generating an invalid pointer
\ndereference.<\/p>\n
Fix this by ensuring that ‘locked_ref’ is set to NULL when
\nbtrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing ‘count’
\nas well, to prevent infinite looping. We do this by doing a goto to the
\nbottom of the loop that already sets ‘locked_ref’ to NULL and does a
\ncond_resched(), with an increment to ‘count’ right before the goto.
\nThese measures were in place before the refactoring in commit 0110a4c43451
\n(“btrfs: refactor __btrfs_run_delayed_refs loop”) but were unintentionally
\nlost afterwards.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()<\/p>\n
In the beginning of the loop, we try to obtain a locked delay<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7268","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}