CVE-2024-56718

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: protect link down work from execute after lgr freed<br /> <br /> link down work may be scheduled before lgr freed but execute<br /> after lgr freed, which may result in crash. So it is need to<br /> hold a reference before shedule link down work, and put the<br /> reference after work executed or canceled.<br /> <br /> The relevant crash call stack as follows:<br /> list_del corruption. prev-&gt;next should be ffffb638c9c0fe20,<br /> but was 0000000000000000<br /> ------------[ cut here ]------------<br /> kernel BUG at lib/list_debug.c:51!<br /> invalid opcode: 0000 [#1] SMP NOPTI<br /> CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1<br /> Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014<br /> Workqueue: events smc_link_down_work [smc]<br /> RIP: 0010:__list_del_entry_valid.cold+0x31/0x47<br /> RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086<br /> RAX: 0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000<br /> RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38<br /> R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002<br /> R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0<br /> FS: 0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> PKRU: 55555554<br /> Call Trace:<br /> rwsem_down_write_slowpath+0x17e/0x470<br /> smc_link_down_work+0x3c/0x60 [smc]<br /> process_one_work+0x1ac/0x350<br /> worker_thread+0x49/0x2f0<br /> ? rescuer_thread+0x360/0x360<br /> kthread+0x118/0x140<br /> ? __kthread_bind_mask+0x60/0x60<br /> ret_from_fork+0x1f/0x30