Description
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to < dec787a15c96a5665e9ffc61b429a6a4ab26e6b9affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < 5eea874a696201c31e7c2d7badbfa0d90e9961b5affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < cf239de7fdcc8336259b01ea4bcf650dadad1040affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < 6d74ecc2be120a0c300b224b7649fe93c0453714affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < 9d44836f60c8c29bcdb1471fd9202387c642a890affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < 2e861ce2aaa468351a6a47c4cbb4971ebb740c7baffected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < 3d60fdf951143d6ef4e352e2f8eb852286701726affected820f9442e711a81749e70c40f149fc54c4ce0ca8 to < f42d0fda0c67695db6bc704b04b7c10240805377affected
Linux Linux
Default version status: affected
3.4affected0 to < 3.4unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/dec787a15c96a5665e9ffc61b429a6a4ab26e6b9 ↗
- https://git.kernel.org/stable/c/5eea874a696201c31e7c2d7badbfa0d90e9961b5 ↗
- https://git.kernel.org/stable/c/cf239de7fdcc8336259b01ea4bcf650dadad1040 ↗
- https://git.kernel.org/stable/c/6d74ecc2be120a0c300b224b7649fe93c0453714 ↗
- https://git.kernel.org/stable/c/9d44836f60c8c29bcdb1471fd9202387c642a890 ↗
- https://git.kernel.org/stable/c/2e861ce2aaa468351a6a47c4cbb4971ebb740c7b ↗
- https://git.kernel.org/stable/c/3d60fdf951143d6ef4e352e2f8eb852286701726 ↗
- https://git.kernel.org/stable/c/f42d0fda0c67695db6bc704b04b7c10240805377 ↗