CVE-2023-54117
- Source
- https://cve.org/CVERecord?id=CVE-2023-54117
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54117.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-54117
- Downstream
- Published
- 2025-12-24T13:06:38.311Z
- Modified
- 2025-12-24T21:04:26.374827Z
- Summary
- s390/dcssblk: fix kernel crash with list_add corruption
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
s390/dcssblk: fix kernel crash with list_add corruption
Commit fb08a1908cb1 ("dax: simplify the daxdevice <-> gendisk association") introduced new logic for gendisk association, requiring drivers to explicitly call daxaddhost() and daxremove_host().
For dcssblk driver, some daxremovehost() calls were missing, e.g. in device remove path. The commit also broke error handling for outdax case in device add path, resulting in an extra putdevice() w/o the previous get_device() in that case.
This lead to stale xarray entries after device add / remove cycles. In the case when a previously used struct gendisk pointer (xarray index) would be used again, because blkallocdisk() happened to return such a pointer, the xainsert() in daxaddhost() would fail and go to outdax, doing the extra putdevice() in the error path. In combination with an already flawed error handling in dcssblk (deviceregister() cleanup), which needs to be addressed in a separate patch, this resulted in a missing devicedel() / klistdel(), and eventually in the kernel crash with listadd corruption on a subsequent deviceadd() / klist_add().
Fix this by adding the missing daxremovehost() calls, and also move the put_device() in the error path to restore the previous logic.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54117.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/6489ec0107860345bc57dcde39e63dfb05ac5c11
- https://git.kernel.org/stable/c/b5c531a9a7d8e047c90c909f09cef06a9f8e62f4
- https://git.kernel.org/stable/c/b7ad75c77349beb4983b9f27108d9b3f33ae1413
- https://git.kernel.org/stable/c/c8f40a0bccefd613748d080147469a4652d6e74c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54117.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-54117
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfb08a1908cb119a4585611d91461ab6d27756b14Fixed6489ec0107860345bc57dcde39e63dfb05ac5c11Fixedb7ad75c77349beb4983b9f27108d9b3f33ae1413Fixedb5c531a9a7d8e047c90c909f09cef06a9f8e62f4Fixedc8f40a0bccefd613748d080147469a4652d6e74c