In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect<\/p>\n
tb_xdp_handle_request() runs on system_wq and queues
\nxd->state_work via queue_delayed_work() in three request handlers:
\nPROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake),
\nand LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues
\nxd->properties_changed_work when local properties change.<\/p>\n
Concurrently, tb_xdomain_remove() calls stop_handshake() which does
\ncancel_delayed_work_sync() on both delayed works. Later,
\ntb_xdomain_unregister() calls device_unregister() which eventually
\nfrees the xdomain. Since commit 559c1e1e0134 (“thunderbolt: Run
\ntb_xdp_handle_request() in system workqueue”) moved the request
\nhandler off tb->wq, the handler and the remove path are no longer
\nserialized. If queue_delayed_work() executes after
\ncancel_delayed_work_sync() but before the xdomain is freed, the
\ndelayed work fires on a freed object.<\/p>\n
Add xd->removing that tb_xdomain_remove() sets under xd->lock
\nbefore calling stop_handshake(). Each external queue site holds
\nthe same lock and checks removing before calling
\nqueue_delayed_work(). This provides the mutual exclusion needed:
\neither the queue site acquires the lock first and queues work that
\nthe subsequent cancel will see, or the remove path acquires the
\nlock first and the queue site observes removing == true and skips
\nthe queue.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect<\/p>\n
tb_xdp_handle_request() runs on system_wq and queues
\nxd->st<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7598","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}