cve/published/2024/CVE-2024-26900.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-26900: md: fix kmemleak of rdev->serial

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

md: fix kmemleak of rdev->serial

If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be
alloc not be freed, and kmemleak occurs.

unreferenced object 0xffff88815a350000 (size 49152):
  comm "mdadm", pid 789, jiffies 4294716910
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc f773277a):
    [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0
    [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270
    [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f
    [<00000000f206d60a>] kvmalloc_node+0x74/0x150
    [<0000000034bf3363>] rdev_init_serial+0x67/0x170
    [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220
    [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630
    [<0000000073c28560>] md_add_new_disk+0x400/0x9f0
    [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10
    [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0
    [<0000000085086a11>] vfs_ioctl+0x22/0x60
    [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0
    [<00000000e54e675e>] do_syscall_64+0x71/0x150
    [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

The Linux kernel CVE team has assigned CVE-2024-26900 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 5.10.217 with commit fb5b347efd1bda989846ffc74679d181222fb123
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 5.15.159 with commit f3a1787dc48213f6caea5ba7d47e0222e7fa34a9
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 6.1.91 with commit beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 6.6.31 with commit 9fd0198f7ef06ae0d6636fb0578560857dead995
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 6.7.11 with commit 6d32c832a88513f65c2c2c9c75954ee8b387adea
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 6.8.2 with commit 4c1021ce46fc2fb6115f7e79d353941e6dcad366
	Issue introduced in 5.3 with commit 963c555e75b033202dd76cf6325a7b7c83d08d5f and fixed in 6.9 with commit 6cf350658736681b9d6b0b6e58c5c76b235bb4c4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26900
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/md.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fb5b347efd1bda989846ffc74679d181222fb123
	https://git.kernel.org/stable/c/f3a1787dc48213f6caea5ba7d47e0222e7fa34a9
	https://git.kernel.org/stable/c/beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9
	https://git.kernel.org/stable/c/9fd0198f7ef06ae0d6636fb0578560857dead995
	https://git.kernel.org/stable/c/6d32c832a88513f65c2c2c9c75954ee8b387adea
	https://git.kernel.org/stable/c/4c1021ce46fc2fb6115f7e79d353941e6dcad366
	https://git.kernel.org/stable/c/6cf350658736681b9d6b0b6e58c5c76b235bb4c4