CVE-2024-26868
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-26868
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26868.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-26868
- Downstream
- Related
- Published
- 2024-04-17T10:27:29Z
- Modified
- 2025-10-21T20:18:20.852775Z
- Summary
- nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nfs: fix panic when nfs4fflayoutprepareds() fails
We've been seeing the following panic in production
BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0 RIP: 0010:fflayoutcancelio+0x3a/0x90 [nfslayoutflexfiles] Call Trace: <TASK> ? _die+0x78/0xc0 ? pagefaultoops+0x286/0x380 ? _rpcexecute+0x2c3/0x470 [sunrpc] ? rpcnewtask+0x42/0x1c0 [sunrpc] ? excpagefault+0x5d/0x110 ? asmexcpagefault+0x22/0x30 ? fflayoutfreelayoutreturn+0x110/0x110 [nfslayoutflexfiles] ? fflayoutcancelio+0x3a/0x90 [nfslayoutflexfiles] ? fflayoutcancelio+0x6f/0x90 [nfslayoutflexfiles] pnfsmarkmatchinglsegsreturn+0x1b0/0x360 [nfsv4] pnfserrormarklayoutforreturn+0x9e/0x110 [nfsv4] ? fflayoutsendlayouterror+0x50/0x160 [nfslayoutflexfiles] nfs4fflayoutprepareds+0x11f/0x290 [nfslayoutflexfiles] fflayoutpginitwrite+0xf0/0x1f0 [nfslayoutflexfiles] _nfspageioaddrequest+0x154/0x6c0 [nfs] nfspageioaddrequest+0x26b/0x380 [nfs] nfsdowritepage+0x111/0x1e0 [nfs] nfswritepagescallback+0xf/0x30 [nfs] writecachepages+0x17f/0x380 ? nfspageioinitwrite+0x50/0x50 [nfs] ? nfswritepages+0x6d/0x210 [nfs] ? nfswritepages+0x6d/0x210 [nfs] nfswritepages+0x125/0x210 [nfs] dowritepages+0x67/0x220 ? genericperformwrite+0x14b/0x210 filemapfdatawritewbc+0x5b/0x80 filewriteandwaitrange+0x6d/0xc0 nfsfilefsync+0x81/0x170 [nfs] ? nfsfilemmap+0x60/0x60 [nfs] _x64sysfsync+0x53/0x90 dosyscall64+0x3d/0x90 entrySYSCALL64after_hwframe+0x46/0xb0
Inspecting the core with drgn I was able to pull this
prog.crashedthread().stacktrace()[0] #0 at 0xffffffffa079657a (fflayoutcancelio+0x3a/0x84) in fflayoutcancelio at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27 prog.crashedthread().stacktrace()[0]['idx'] (u32)1 prog.crashedthread().stacktrace()[0]['flseg'].mirrorarray[1].mirrords (struct nfs4fflayout_ds *)0xffffffffffffffed
This is clear from the stack trace, we call nfs4fflayoutprepareds() which could error out initializing the mirrords, and then we go to clean it all up and our check is only for if (!mirror->mirrords). This is inconsistent with the rest of the users of mirror_ds, which have
if (ISERRORNULL(mirrords))
to keep from tripping over this exact scenario. Fix this up in fflayoutcancelio() to make sure we don't panic when we get an error. I also spot checked all the other instances of checking mirrords and we appear to be doing the correct checks everywhere, only unconditionally dereferencing mirror_ds when we know it would be valid.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/31db25e3141b20e2a76a9f219eeca52e3cab126c
- https://git.kernel.org/stable/c/5ada9016b1217498fad876a3d5b07645cc955608
- https://git.kernel.org/stable/c/719fcafe07c12646691bd62d7f8d94d657fa0766
- https://git.kernel.org/stable/c/7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5
- https://git.kernel.org/stable/c/dac068f164ad05b35e7c0be13f138c3f6adca58f
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb739a5bd9d9f18cc69dced8db128ef7206e000cdFixed31db25e3141b20e2a76a9f219eeca52e3cab126c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb739a5bd9d9f18cc69dced8db128ef7206e000cdFixed7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb739a5bd9d9f18cc69dced8db128ef7206e000cdFixed5ada9016b1217498fad876a3d5b07645cc955608
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb739a5bd9d9f18cc69dced8db128ef7206e000cdFixeddac068f164ad05b35e7c0be13f138c3f6adca58f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb739a5bd9d9f18cc69dced8db128ef7206e000cdFixed719fcafe07c12646691bd62d7f8d94d657fa0766