In the Linux kernel, the following vulnerability has been resolved:
interconnect: Don't access req_list while it's being manipulated
The icclock mutex was split into separate icclock and iccbwlock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to iccnode::reqlist.
The iccsetbw() function will eventually iterate over reqlist while only holding iccbwlock, but reqlist can be modified while only holding icclock. This causes races between iccsetbw(), oficcget(), and iccput().
Example A:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); iccput(pathb) mutexlock(&icclock); aggregaterequests() hlistforeachentry(r, ... hlist_del(... <r = invalid pointer>
Example B:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); pathb = oficcget() oficcgetbyindex() mutexlock(&icclock); pathfind() pathinit() aggregaterequests() hlistforeachentry(r, ... hlistadd_head(... <r = invalid pointer>
Fix this by ensuring iccbwlock is always held before manipulating iccnode::reqlist. The additional places iccbwlock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.
[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
[
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "257238212086354019154378080518580490819",
                "231935988270940396041131047058768899701",
                "127026139454374449863413193401663830891",
                "95799830460802096318033948055643481221",
                "257036486196434344333984628454455535788",
                "187599749556814087399606703731116168704",
                "306060219178507094775146470056266431810",
                "208782855867795861370938750908063502653",
                "112532505933438965597300332148487874932",
                "339808879840379578446378861943054347348",
                "117696493154326354443968609650699724101",
                "137856540454154038766688701374432720414",
                "62122239142030655253581528296888619527",
                "168889082051275062982755089295353695185",
                "154969683757377387984752892612548505880",
                "292089882633022903748892845741686390013"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2024-27005-0d08067e",
        "target": {
            "file": "drivers/interconnect/core.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "257238212086354019154378080518580490819",
                "231935988270940396041131047058768899701",
                "127026139454374449863413193401663830891",
                "95799830460802096318033948055643481221",
                "257036486196434344333984628454455535788",
                "187599749556814087399606703731116168704",
                "306060219178507094775146470056266431810",
                "208782855867795861370938750908063502653",
                "112532505933438965597300332148487874932",
                "339808879840379578446378861943054347348",
                "117696493154326354443968609650699724101",
                "137856540454154038766688701374432720414",
                "62122239142030655253581528296888619527",
                "168889082051275062982755089295353695185",
                "154969683757377387984752892612548505880",
                "292089882633022903748892845741686390013"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2024-27005-1dd43fb4",
        "target": {
            "file": "drivers/interconnect/core.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 549.0,
            "function_hash": "313539557631311563358028680411891277535"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-44e3a117",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "path_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 553.0,
            "function_hash": "91873765838109941753716586194724813957"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-8244adac",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "icc_put"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "257238212086354019154378080518580490819",
                "231935988270940396041131047058768899701",
                "127026139454374449863413193401663830891",
                "95799830460802096318033948055643481221",
                "257036486196434344333984628454455535788",
                "187599749556814087399606703731116168704",
                "306060219178507094775146470056266431810",
                "208782855867795861370938750908063502653",
                "112532505933438965597300332148487874932",
                "339808879840379578446378861943054347348",
                "117696493154326354443968609650699724101",
                "137856540454154038766688701374432720414",
                "62122239142030655253581528296888619527",
                "168889082051275062982755089295353695185",
                "154969683757377387984752892612548505880",
                "292089882633022903748892845741686390013"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2024-27005-a1ffbead",
        "target": {
            "file": "drivers/interconnect/core.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 553.0,
            "function_hash": "91873765838109941753716586194724813957"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-b3d22d1d",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "icc_put"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 549.0,
            "function_hash": "313539557631311563358028680411891277535"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-d8552aca",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "path_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de1bf25b6d771abdb52d43546cf57ad775fb68a1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 549.0,
            "function_hash": "313539557631311563358028680411891277535"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-e001bfa9",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "path_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0d04efa2e367921654b5106cc5c05e3757c2b42",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 553.0,
            "function_hash": "91873765838109941753716586194724813957"
        },
        "signature_type": "Function",
        "id": "CVE-2024-27005-ffc090ca",
        "target": {
            "file": "drivers/interconnect/core.c",
            "function": "icc_put"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c65507121ea8e0b47fae6d2049c8688390d46b6",
        "deprecated": false
    }
]