In the Linux kernel, the following vulnerability has been resolved:
interconnect: Don't access req_list while it's being manipulated
The icclock mutex was split into separate icclock and iccbwlock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to iccnode::reqlist.
The iccsetbw() function will eventually iterate over reqlist while only holding iccbwlock, but reqlist can be modified while only holding icclock. This causes races between iccsetbw(), oficcget(), and iccput().
Example A:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); iccput(pathb) mutexlock(&icclock); aggregaterequests() hlistforeachentry(r, ... hlist_del(... <r = invalid pointer>
Example B:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); pathb = oficcget() oficcgetbyindex() mutexlock(&icclock); pathfind() pathinit() aggregaterequests() hlistforeachentry(r, ... hlistadd_head(... <r = invalid pointer>
Fix this by ensuring iccbwlock is always held before manipulating iccnode::reqlist. The additional places iccbwlock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.
[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
[
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"257238212086354019154378080518580490819",
"231935988270940396041131047058768899701",
"127026139454374449863413193401663830891",
"95799830460802096318033948055643481221",
"257036486196434344333984628454455535788",
"187599749556814087399606703731116168704",
"306060219178507094775146470056266431810",
"208782855867795861370938750908063502653",
"112532505933438965597300332148487874932",
"339808879840379578446378861943054347348",
"117696493154326354443968609650699724101",
"137856540454154038766688701374432720414",
"62122239142030655253581528296888619527",
"168889082051275062982755089295353695185",
"154969683757377387984752892612548505880",
"292089882633022903748892845741686390013"
]
},
"id": "CVE-2024-27005-0d08067e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"257238212086354019154378080518580490819",
"231935988270940396041131047058768899701",
"127026139454374449863413193401663830891",
"95799830460802096318033948055643481221",
"257036486196434344333984628454455535788",
"187599749556814087399606703731116168704",
"306060219178507094775146470056266431810",
"208782855867795861370938750908063502653",
"112532505933438965597300332148487874932",
"339808879840379578446378861943054347348",
"117696493154326354443968609650699724101",
"137856540454154038766688701374432720414",
"62122239142030655253581528296888619527",
"168889082051275062982755089295353695185",
"154969683757377387984752892612548505880",
"292089882633022903748892845741686390013"
]
},
"id": "CVE-2024-27005-1dd43fb4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "path_init"
},
"digest": {
"length": 549.0,
"function_hash": "313539557631311563358028680411891277535"
},
"id": "CVE-2024-27005-44e3a117",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_put"
},
"digest": {
"length": 553.0,
"function_hash": "91873765838109941753716586194724813957"
},
"id": "CVE-2024-27005-8244adac",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"257238212086354019154378080518580490819",
"231935988270940396041131047058768899701",
"127026139454374449863413193401663830891",
"95799830460802096318033948055643481221",
"257036486196434344333984628454455535788",
"187599749556814087399606703731116168704",
"306060219178507094775146470056266431810",
"208782855867795861370938750908063502653",
"112532505933438965597300332148487874932",
"339808879840379578446378861943054347348",
"117696493154326354443968609650699724101",
"137856540454154038766688701374432720414",
"62122239142030655253581528296888619527",
"168889082051275062982755089295353695185",
"154969683757377387984752892612548505880",
"292089882633022903748892845741686390013"
]
},
"id": "CVE-2024-27005-a1ffbead",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_put"
},
"digest": {
"length": 553.0,
"function_hash": "91873765838109941753716586194724813957"
},
"id": "CVE-2024-27005-b3d22d1d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "path_init"
},
"digest": {
"length": 549.0,
"function_hash": "313539557631311563358028680411891277535"
},
"id": "CVE-2024-27005-d8552aca",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "path_init"
},
"digest": {
"length": 549.0,
"function_hash": "313539557631311563358028680411891277535"
},
"id": "CVE-2024-27005-e001bfa9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_put"
},
"digest": {
"length": 553.0,
"function_hash": "91873765838109941753716586194724813957"
},
"id": "CVE-2024-27005-ffc090ca",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
"signature_version": "v1"
}
]