CVE-2024-40900

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cachefiles: remove requests from xarray during flushing requests<br /> <br /> Even with CACHEFILES_DEAD set, we can still read the requests, so in the<br /> following concurrency the request may be used after it has been freed:<br /> <br /> mount | daemon_thread1 | daemon_thread2<br /> ------------------------------------------------------------<br /> cachefiles_ondemand_init_object<br /> cachefiles_ondemand_send_req<br /> REQ_A = kzalloc(sizeof(*req) + data_len)<br /> wait_for_completion(&amp;REQ_A-&gt;done)<br /> cachefiles_daemon_read<br /> cachefiles_ondemand_daemon_read<br /> // close dev fd<br /> cachefiles_flush_reqs<br /> complete(&amp;REQ_A-&gt;done)<br /> kfree(REQ_A)<br /> xa_lock(&amp;cache-&gt;reqs);<br /> cachefiles_ondemand_select_req<br /> req-&gt;msg.opcode != CACHEFILES_OP_READ<br /> // req use-after-free !!!<br /> xa_unlock(&amp;cache-&gt;reqs);<br /> xa_destroy(&amp;cache-&gt;reqs)<br /> <br /> Hence remove requests from cache-&gt;reqs when flushing them to avoid<br /> accessing freed requests.