In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()<\/p>\n
The failed_dev_add and failed_dev_name paths drop the file-device
\nreference while wq->wq_lock is still held. If put_device(fdev) drops the
\nlast reference, idxd_file_dev_release() runs synchronously and tries to
\ntake wq->wq_lock again, deadlocking.<\/p>\n
Those paths also fall through into the later ctx cleanup labels even
\nthough idxd_file_dev_release() owns that cleanup and frees ctx. This can
\nmake idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.<\/p>\n
Move idxd_wq_get() before file-device setup can fail, since the release
\ncallback always calls idxd_wq_put(). Then unlock wq->wq_lock before
\nput_device(fdev) and return directly from the file-device setup failure
\npath, leaving ctx cleanup to the release callback.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()<\/p>\n
The failed_dev_add and failed_dev_name paths drop the file-dev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8876","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}