cve/published/2024/CVE-2024-48881.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again

Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
node allocations") leads a NULL pointer deference in cache_set_flush().

1721         if (!IS_ERR_OR_NULL(c->root))
1722                 list_add(&c->root->list, &c->btree_cache);

>From the above code in cache_set_flush(), if previous registration code
fails before allocating c->root, it is possible c->root is NULL as what
it is initialized. __bch_btree_node_alloc() never returns NULL but
c->root is possible to be NULL at above line 1721.

This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.

The Linux kernel CVE team has assigned CVE-2024-48881 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4.251 with commit 0729029e647234fa1a94376b6edffec5c2cd75f6 and fixed in 5.4.287 with commit 4379c5828492a4c2a651c8f826a01453bd2b80b0
	Issue introduced in 5.10.188 with commit db9439cef0b5efccf8021fe89f4953e0f901e85b and fixed in 5.10.231 with commit 336e30f32ae7c043fde0f6fa21586ff30bea9fe2
	Issue introduced in 5.15.121 with commit 991e9c186a8ac6ab272a86e0ddc6f9733c38b867 and fixed in 5.15.174 with commit fb5fee35bdd18316a84b5f30881a24e1415e1464
	Issue introduced in 6.1.39 with commit 68118c339c6e1e16ae017bef160dbe28a27ae9c8 and fixed in 6.1.120 with commit 5202391970ffbf81975251b3526b890ba027b715
	Issue introduced in 6.5 with commit 028ddcac477b691dd9205c92f991cc15259d033e and fixed in 6.6.66 with commit cc05aa2c0117e20fa25a3c0d915f98b8f2e78667
	Issue introduced in 6.5 with commit 028ddcac477b691dd9205c92f991cc15259d033e and fixed in 6.12.5 with commit 5e0e913624bcd24f3de414475018d3023f060ee1
	Issue introduced in 6.5 with commit 028ddcac477b691dd9205c92f991cc15259d033e and fixed in 6.13 with commit b2e382ae12a63560fca35050498e19e760adf8c0
	Issue introduced in 4.19.291 with commit fe75e8a0c20127a8dc95704f1a7ad6b82c9a0ef8
	Issue introduced in 6.4.4 with commit 0cabf9e164660e8d66c4810396046383a1110a69

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-48881
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/bcache/super.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4379c5828492a4c2a651c8f826a01453bd2b80b0
	https://git.kernel.org/stable/c/336e30f32ae7c043fde0f6fa21586ff30bea9fe2
	https://git.kernel.org/stable/c/fb5fee35bdd18316a84b5f30881a24e1415e1464
	https://git.kernel.org/stable/c/5202391970ffbf81975251b3526b890ba027b715
	https://git.kernel.org/stable/c/cc05aa2c0117e20fa25a3c0d915f98b8f2e78667
	https://git.kernel.org/stable/c/5e0e913624bcd24f3de414475018d3023f060ee1
	https://git.kernel.org/stable/c/b2e382ae12a63560fca35050498e19e760adf8c0