In the Linux kernel, the following vulnerability has been resolved:
blk-mq: make sure active queue usage is held for biointegrityprep()
blkintegrityunregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic.
Another constraint is that biointegrityprep() needs to be called before bio merge.
Fix the issue by:
call biointegrityprep() with one queue usage counter grabbed reliably
call biointegrityprep() before bio merge
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "90186791682360618367334992267616972442", "303297421369387959931337669218204858670", "192558856143659222074714049820781433666", "265187206319116207064539680064431884249", "227882602050548310485203380257934864148", "187771150623155003384518341038300310076", "311202013038587654566904033672163039147", "186809956214588987891708889451540062085", "169455106619552153893162854922567075567", "313467736639788663473813959146142209659", "112964045784240395692025060574691028595", "68059359379873798625518284463328287471", "292552394989076577966329108583553810704", "221287786219308468512496188096309660800", "219093599660242657975956318188831234092", "165789225028367694853097433102568788879", "81900989996507656255453361362297905244", "117693298278167315402214670221298799472", "262287525647004322662000769170745784901", "227551361344574003234317907901232319952", "217581480608150105453680644426202825553", "80169188982668356110359669809220195641", "122570953974887965342582715251588192712", "166330585779663359873967732735863340722", "268950637497001071692723375631987168600", "140262197950456006985167362079817617609", "186463529576206280779254751806772275176", "309821561671649401381949956914538203620", "101057052078890812840144064233325759236", "173914874496991985956620440676870923525", "11482403365908562578208028407416749648", "207553235683566770665640362478455317940", "235035562970451046209794867977171448513", "31526667314986796522723385512355679953", "10770247897461467001984407232733316123", "25707870265753798436554328640266505199", "167159664628779792716894154721812657241", "141438533883331388923479777042631333248", "267241808698237529850155227919715267356", "161338706256407720037447748736043171534", "266620367756630262194424802762568424284", "147948854067806361600951821817348383760", "101163125963718958080265162957380726373", "118387852702184010226960443714199893578", "131892216217006981849601439638095457361", "77528225359813657924351064214729293682", "259821985282850994949519964060055535602", "105333857014009852825514519513323948932", "3887393141401655166646096723727204671", "100772480289484844032988974511495917255", "308137024896632628451841580213571865651", "276711968874456057919357331868534381900", "23036224123599881203952092458269375759", "188223257003941931171916384717362606630", "29600315912617463301275027242585612094", "154953104926148169956036875048866552789", "44985388703982644741448196161645095422", "164649791660364160495122579279646184998" ] }, "target": { "file": "block/blk-mq.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "signature_version": "v1", "id": "CVE-2023-52787-1227b4f8", "signature_type": "Line" }, { "digest": { "length": 1156.0, "function_hash": "52902844549651751363226636338555811250" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_submit_bio" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "signature_version": "v1", "id": "CVE-2023-52787-413079f4", "signature_type": "Function" }, { "digest": { "length": 639.0, "function_hash": "166341918775987777360902024577132529521" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_get_new_requests" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80056bd75a16e4550873ecefe12bc8fd190b1cf", "signature_version": "v1", "id": "CVE-2023-52787-702c05f2", "signature_type": "Function" }, { "digest": { "length": 1191.0, "function_hash": "277503855272523834053961536650223784245" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_submit_bio" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80056bd75a16e4550873ecefe12bc8fd190b1cf", "signature_version": "v1", "id": "CVE-2023-52787-9a8bbe8b", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "90186791682360618367334992267616972442", "303297421369387959931337669218204858670", "192558856143659222074714049820781433666", "265187206319116207064539680064431884249", "227882602050548310485203380257934864148", "187771150623155003384518341038300310076", "311202013038587654566904033672163039147", "186809956214588987891708889451540062085", "169455106619552153893162854922567075567", "313467736639788663473813959146142209659", "112964045784240395692025060574691028595", "68059359379873798625518284463328287471", "292552394989076577966329108583553810704", "221287786219308468512496188096309660800", "219093599660242657975956318188831234092", "165789225028367694853097433102568788879", "81900989996507656255453361362297905244", "117693298278167315402214670221298799472", "262287525647004322662000769170745784901", "227551361344574003234317907901232319952", "217581480608150105453680644426202825553", "80169188982668356110359669809220195641", "122570953974887965342582715251588192712", "166330585779663359873967732735863340722", "268950637497001071692723375631987168600", "140262197950456006985167362079817617609", "186463529576206280779254751806772275176", "309821561671649401381949956914538203620", "101057052078890812840144064233325759236", "173914874496991985956620440676870923525", "11482403365908562578208028407416749648", "207553235683566770665640362478455317940", "235035562970451046209794867977171448513", "31526667314986796522723385512355679953", "6414002035306815930682299207047346905", "80001118970835644236167609324948933390", "265409919087992901218593489386386324001", "266333915873212976860431084154524218974", "141438533883331388923479777042631333248", "267241808698237529850155227919715267356", "161338706256407720037447748736043171534", "243432383202506704538682197721424302877", "109378171767418019199259038486848187931", "207347966786327077503468203882539366322", "118387852702184010226960443714199893578", "131892216217006981849601439638095457361", "77528225359813657924351064214729293682", "259821985282850994949519964060055535602", "105333857014009852825514519513323948932", "3887393141401655166646096723727204671", "100772480289484844032988974511495917255", "308137024896632628451841580213571865651", "276711968874456057919357331868534381900", "23036224123599881203952092458269375759", "188223257003941931171916384717362606630", "29600315912617463301275027242585612094", "154953104926148169956036875048866552789", "44985388703982644741448196161645095422", "164649791660364160495122579279646184998" ] }, "target": { "file": "block/blk-mq.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80056bd75a16e4550873ecefe12bc8fd190b1cf", "signature_version": "v1", "id": "CVE-2023-52787-9c6b88af", "signature_type": "Line" }, { "digest": { "length": 780.0, "function_hash": "180747612357945603864436058479615805547" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_get_cached_request" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80056bd75a16e4550873ecefe12bc8fd190b1cf", "signature_version": "v1", "id": "CVE-2023-52787-9d05cc9f", "signature_type": "Function" }, { "digest": { "length": 639.0, "function_hash": "166341918775987777360902024577132529521" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_get_new_requests" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "signature_version": "v1", "id": "CVE-2023-52787-cd73bded", "signature_type": "Function" }, { "digest": { "length": 757.0, "function_hash": "12544275462796756323838579118597156367" }, "target": { "file": "block/blk-mq.c", "function": "blk_mq_get_cached_request" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "signature_version": "v1", "id": "CVE-2023-52787-e2b0ca6d", "signature_type": "Function" } ] }