Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]RDMA/rxe: Fix race in do_task() when draining[EOL][EOL]When do_task() exhausts its iteration budget (!ret), it sets the state[EOL]to TASK_STATE_IDLE to reschedule, without a secondary check on the[EOL]current task->state. This can overwrite the TASK_STATE_DRAINING state[EOL]set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().[EOL][EOL]While state changes are protected by a spinlock, both rxe_cleanup_task()[EOL]and rxe_disable_task() release the lock while waiting for the task to[EOL]finish draining in the while(!is_done(task)) loop. The race occurs if[EOL]do_task() hits its iteration limit and acquires the lock in this window.[EOL]The cleanup logic may then proceed while the task incorrectly[EOL]reschedules itself, leading to a potential use-after-free.[EOL][EOL]This bug was introduced during the migration from tasklets to workqueues,[EOL]where the special handling for the draining case was lost.[EOL][EOL]Fix this by restoring the original pre-migration behavior. If the state is[EOL]TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to[EOL]force a new loop iteration. This allows the task to finish its work, so[EOL]that a subsequent iteration can reach the switch statement and correctly[EOL]transition the state to TASK_STATE_DRAINED, stopping the task as intended.