CVE-2023-53531

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> null_blk: fix poll request timeout handling<br /> <br /> When doing io_uring benchmark on /dev/nullb0, it&amp;#39;s easy to crash the<br /> kernel if poll requests timeout triggered, as reported by David. [1]<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000008<br /> Workqueue: kblockd blk_mq_timeout_work<br /> RIP: 0010:null_timeout_rq+0x4e/0x91<br /> Call Trace:<br /> ? null_timeout_rq+0x4e/0x91<br /> blk_mq_handle_expired+0x31/0x4b<br /> bt_iter+0x68/0x84<br /> ? bt_tags_iter+0x81/0x81<br /> __sbitmap_for_each_set.constprop.0+0xb0/0xf2<br /> ? __blk_mq_complete_request_remote+0xf/0xf<br /> bt_for_each+0x46/0x64<br /> ? __blk_mq_complete_request_remote+0xf/0xf<br /> ? percpu_ref_get_many+0xc/0x2a<br /> blk_mq_queue_tag_busy_iter+0x14d/0x18e<br /> blk_mq_timeout_work+0x95/0x127<br /> process_one_work+0x185/0x263<br /> worker_thread+0x1b5/0x227<br /> <br /> This is indeed a race problem between null_timeout_rq() and null_poll().<br /> <br /> null_poll() null_timeout_rq()<br /> spin_lock(&amp;nq-&gt;poll_lock)<br /> list_splice_init(&amp;nq-&gt;poll_list, &amp;list)<br /> spin_unlock(&amp;nq-&gt;poll_lock)<br /> <br /> while (!list_empty(&amp;list))<br /> req = list_first_entry()<br /> list_del_init()<br /> ...<br /> blk_mq_add_to_batch()<br /> // req-&gt;rq_next = NULL<br /> spin_lock(&amp;nq-&gt;poll_lock)<br /> <br /> // rq-&gt;queuelist-&gt;next == NULL<br /> list_del_init(&amp;rq-&gt;queuelist)<br /> <br /> spin_unlock(&amp;nq-&gt;poll_lock)<br /> <br /> Fix these problems by setting requests state to MQ_RQ_COMPLETE under<br /> nq-&gt;poll_lock protection, in which null_timeout_rq() can safely detect<br /> this race and early return.<br /> <br /> Note this patch just fix the kernel panic when request timeout happen.<br /> <br /> [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/