| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down |
| |
| There is a history of deadlock if reboot is performed at the beginning |
| of booting. SDEV_QUIESCE was set for all LU's scsi_devices by UFS |
| shutdown, and at that time the audio driver was waiting on |
| blk_mq_submit_bio() holding a mutex_lock while reading the fw binary. |
| After that, a deadlock issue occurred while audio driver shutdown was |
| waiting for mutex_unlock of blk_mq_submit_bio(). To solve this, set |
| SDEV_OFFLINE for all LUs except WLUN, so that any I/O that comes down |
| after a UFS shutdown will return an error. |
| |
| [ 31.907781]I[0: swapper/0: 0] 1 130705007 1651079834 11289729804 0 D( 2) 3 ffffff882e208000 * init [device_shutdown] |
| [ 31.907793]I[0: swapper/0: 0] Mutex: 0xffffff8849a2b8b0: owner[0xffffff882e28cb00 kworker/6:0 :49] |
| [ 31.907806]I[0: swapper/0: 0] Call trace: |
| [ 31.907810]I[0: swapper/0: 0] __switch_to+0x174/0x338 |
| [ 31.907819]I[0: swapper/0: 0] __schedule+0x5ec/0x9cc |
| [ 31.907826]I[0: swapper/0: 0] schedule+0x7c/0xe8 |
| [ 31.907834]I[0: swapper/0: 0] schedule_preempt_disabled+0x24/0x40 |
| [ 31.907842]I[0: swapper/0: 0] __mutex_lock+0x408/0xdac |
| [ 31.907849]I[0: swapper/0: 0] __mutex_lock_slowpath+0x14/0x24 |
| [ 31.907858]I[0: swapper/0: 0] mutex_lock+0x40/0xec |
| [ 31.907866]I[0: swapper/0: 0] device_shutdown+0x108/0x280 |
| [ 31.907875]I[0: swapper/0: 0] kernel_restart+0x4c/0x11c |
| [ 31.907883]I[0: swapper/0: 0] __arm64_sys_reboot+0x15c/0x280 |
| [ 31.907890]I[0: swapper/0: 0] invoke_syscall+0x70/0x158 |
| [ 31.907899]I[0: swapper/0: 0] el0_svc_common+0xb4/0xf4 |
| [ 31.907909]I[0: swapper/0: 0] do_el0_svc+0x2c/0xb0 |
| [ 31.907918]I[0: swapper/0: 0] el0_svc+0x34/0xe0 |
| [ 31.907928]I[0: swapper/0: 0] el0t_64_sync_handler+0x68/0xb4 |
| [ 31.907937]I[0: swapper/0: 0] el0t_64_sync+0x1a0/0x1a4 |
| |
| [ 31.908774]I[0: swapper/0: 0] 49 0 11960702 11236868007 0 D( 2) 6 ffffff882e28cb00 * kworker/6:0 [__bio_queue_enter] |
| [ 31.908783]I[0: swapper/0: 0] Call trace: |
| [ 31.908788]I[0: swapper/0: 0] __switch_to+0x174/0x338 |
| [ 31.908796]I[0: swapper/0: 0] __schedule+0x5ec/0x9cc |
| [ 31.908803]I[0: swapper/0: 0] schedule+0x7c/0xe8 |
| [ 31.908811]I[0: swapper/0: 0] __bio_queue_enter+0xb8/0x178 |
| [ 31.908818]I[0: swapper/0: 0] blk_mq_submit_bio+0x194/0x67c |
| [ 31.908827]I[0: swapper/0: 0] __submit_bio+0xb8/0x19c |
| |
| The Linux kernel CVE team has assigned CVE-2024-50098 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.14 with commit b294ff3e34490f36233230e9ca70503d3924a6f3 and fixed in 6.1.114 with commit 7de759fceacff5660abf9590d11114215a9d5f3c |
| Issue introduced in 5.14 with commit b294ff3e34490f36233230e9ca70503d3924a6f3 and fixed in 6.6.58 with commit 7bd9af254275fad7071d85f04616560deb598d7d |
| Issue introduced in 5.14 with commit b294ff3e34490f36233230e9ca70503d3924a6f3 and fixed in 6.11.5 with commit 7774d23622416dbbbdb21bf342b3f0d92cf1dc0f |
| Issue introduced in 5.14 with commit b294ff3e34490f36233230e9ca70503d3924a6f3 and fixed in 6.12 with commit 19a198b67767d952c8f3d0cf24eb3100522a8223 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50098 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/ufs/core/ufshcd.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7de759fceacff5660abf9590d11114215a9d5f3c |
| https://git.kernel.org/stable/c/7bd9af254275fad7071d85f04616560deb598d7d |
| https://git.kernel.org/stable/c/7774d23622416dbbbdb21bf342b3f0d92cf1dc0f |
| https://git.kernel.org/stable/c/19a198b67767d952c8f3d0cf24eb3100522a8223 |
