CVE-2024-41051

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cachefiles: wait for ondemand_object_worker to finish when dropping object<br /> <br /> When queuing ondemand_object_worker() to re-open the object,<br /> cachefiles_object is not pinned. The cachefiles_object may be freed when<br /> the pending read request is completed intentionally and the related<br /> erofs is umounted. If ondemand_object_worker() runs after the object is<br /> freed, it will incur use-after-free problem as shown below.<br /> <br /> process A processs B process C process D<br /> <br /> cachefiles_ondemand_send_req()<br /> // send a read req X<br /> // wait for its completion<br /> <br /> // close ondemand fd<br /> cachefiles_ondemand_fd_release()<br /> // set object as CLOSE<br /> <br /> cachefiles_ondemand_daemon_read()<br /> // set object as REOPENING<br /> queue_work(fscache_wq, &amp;info-&gt;ondemand_work)<br /> <br /> // close /dev/cachefiles<br /> cachefiles_daemon_release<br /> cachefiles_flush_reqs<br /> complete(&amp;req-&gt;done)<br /> <br /> // read req X is completed<br /> // umount the erofs fs<br /> cachefiles_put_object()<br /> // object will be freed<br /> cachefiles_ondemand_deinit_obj_info()<br /> kmem_cache_free(object)<br /> // both info and object are freed<br /> ondemand_object_worker()<br /> <br /> When dropping an object, it is no longer necessary to reopen the object,<br /> so use cancel_work_sync() to cancel or wait for ondemand_object_worker()<br /> to finish.