In the Linux kernel, the following vulnerability has been resolved:
pipe: wakeup wrwait after setting maxusage
Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1].
The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wrwait before actually raising pipe->maxusage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write.
Set @maxusage and @nraccounted before waking writers if this isn't a watch queue.
[Christian Brauner brauner@kernel.org: rewrite to account for watch queues]
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-030584e9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-0f4b4924", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-41cef85f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-5620b91e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-62a7be74", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-765c3c11", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-9464133a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-967b9d22", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-9ace4fb8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-9f54ecbd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-a57f8d99", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-c26500a2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-d4ce0c7a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-d5ce6186", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_resize_ring" }, "signature_version": "v1", "digest": { "length": 1147.0, "function_hash": "289121527880973361560121176102384726962" }, "id": "CVE-2023-52672-d75db676", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/pipe.c", "function": "pipe_set_size" }, "signature_version": "v1", "digest": { "length": 832.0, "function_hash": "133935251437513279003239827568118316817" }, "id": "CVE-2023-52672-de830780", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-f2708444", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/pipe.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "217062505888524572579491177644823012083", "255469989805010112906013563958714600072", "288387231261374301005455641179088070508", "237821751742225235143763825773657587518", "242362475035631710331672047777964582975", "114058008960951322409692025135431723066", "269900224170960528558941057652309771787", "104274289077379533324476217044424076282" ], "threshold": 0.9 }, "id": "CVE-2023-52672-fca12b9f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8" } ] }