In the Linux kernel, the following vulnerability has been resolved:
padata: avoid UAF for reorder_work
Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below:
cryptorequest cryptorequest cryptodelalg padatadoserial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }
            padata_do_serial
              // new request added
              list_add
// sees the new request
queue_work(reorder_work)
              padata_reorder
                queue_work_on(squeue->work)
...
            <kworker context>
            padata_serial_worker
            // completes new request,
            // no more outstanding
            // requests
                        crypto_del_alg
                          // free pd
<kworker context> invokepadatareorder // UAF of pd
To avoid UAF for 'reorderwork', get 'pd' ref before put 'reorderwork' into the 'serialwq' and put 'pd' ref until the 'serialwq' finish.