In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost: fix vhost_get_avail_idx for a non empty ring<\/p>\n
vhost_get_avail_idx is supposed to report whether it has updated
\nvq->avail_idx. Instead, it returns whether all entries have been
\nconsumed, which is usually the same. But not always – in
\ndrivers\/vhost\/net.c and when mergeable buffers have been enabled, the
\ndriver checks whether the combined entries are big enough to store an
\nincoming packet. If not, the driver re-enables notifications with
\navailable entries still in the ring. The incorrect return value from
\nvhost_get_avail_idx propagates through vhost_enable_notify and causes
\nthe host to livelock if the guest is not making progress, as vhost will
\nimmediately disable notifications and retry using the available entries.<\/p>\n
This goes back to commit d3bb267bbdcb (“vhost: cache avail index in
\nvhost_enable_notify()”) which changed vhost_enable_notify() to compare
\nthe freshly read avail index against vq->last_avail_idx instead of the
\npreviously cached vq->avail_idx. Commit 7ad472397667 (“vhost: move
\nsmp_rmb() into vhost_get_avail_idx()”) then carried over the same
\ncomparison when refactoring vhost_enable_notify() to call the unified
\nvhost_get_avail_idx().<\/p>\n
The obvious fix is to make vhost_get_avail_idx do what the comment
\nsays it does and report whether new entries have been added.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost: fix vhost_get_avail_idx for a non empty ring<\/p>\n
vhost_get_avail_idx is supposed to report whether it has updated
\nvq->avail_idx<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8586","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}