| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-27023: md: Fix missing release of 'active_io' for flush |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| md: Fix missing release of 'active_io' for flush |
| |
| submit_flushes |
| atomic_set(&mddev->flush_pending, 1); |
| rdev_for_each_rcu(rdev, mddev) |
| atomic_inc(&mddev->flush_pending); |
| bi->bi_end_io = md_end_flush |
| submit_bio(bi); |
| /* flush io is done first */ |
| md_end_flush |
| if (atomic_dec_and_test(&mddev->flush_pending)) |
| percpu_ref_put(&mddev->active_io) |
| -> active_io is not released |
| |
| if (atomic_dec_and_test(&mddev->flush_pending)) |
| -> missing release of active_io |
| |
| For consequence, mddev_suspend() will wait for 'active_io' to be zero |
| forever. |
| |
| Fix this problem by releasing 'active_io' in submit_flushes() if |
| 'flush_pending' is decreased to zero. |
| |
| The Linux kernel CVE team has assigned CVE-2024-27023 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.1.75 with commit f9f2d957a8ea93c73182aebf7de30935a58c027d and fixed in 6.1.80 with commit 6b2ff10390b19a2364af622b6666b690443f9f3f |
| Issue introduced in 6.6.14 with commit 530cec617f5a8ba6f26bcbf0d64d75c951d17730 and fixed in 6.6.19 with commit 02dad157ba11064d073f5499dc33552b227d5d3a |
| Issue introduced in 6.7.2 with commit c4c2345214b66e2505a26fd2ea58839dd7a1d48d and fixed in 6.7.7 with commit 11f81438927f84edfaaeb5d5f10856c3a1c1fc82 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-27023 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/md/md.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/6b2ff10390b19a2364af622b6666b690443f9f3f |
| https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a |
| https://git.kernel.org/stable/c/11f81438927f84edfaaeb5d5f10856c3a1c1fc82 |
| https://git.kernel.org/stable/c/855678ed8534518e2b428bcbcec695de9ba248e8 |
