Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
23721387c409087fd3b97e274f34d3ddc0970b74 to < 1f013bc94154f2e78e97d0296175664224c796e0affected23721387c409087fd3b97e274f34d3ddc0970b74 to < 5328b95960774f2e189f22485616bc7b8eb2f7e3affected23721387c409087fd3b97e274f34d3ddc0970b74 to < 8ff9c59d1b7b48c2596878341a5310f32895d52baffected23721387c409087fd3b97e274f34d3ddc0970b74 to < a9393751ecf7e9096f93cb6eed02db4f79125765affected23721387c409087fd3b97e274f34d3ddc0970b74 to < 461f1e3dfb888701895b766446c55db2b10db705affected23721387c409087fd3b97e274f34d3ddc0970b74 to < 45384612f29692fbf0c770200361a7acff90125caffected23721387c409087fd3b97e274f34d3ddc0970b74 to < 65497ad155a3246df177b5ef662cd6e5a32cb470affected23721387c409087fd3b97e274f34d3ddc0970b74 to < 83ab69bd12b80f6ea169c8bea6977701b53a043daffected
Linux Linux
Default version status: affected
3.5affected0 to < 3.5unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0 ↗
- https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3 ↗
- https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b ↗
- https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765 ↗
- https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705 ↗
- https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c ↗
- https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470 ↗
- https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d ↗