In the Linux kernel, the following vulnerability has been resolved:
nullblk: fix null-ptr-dereference while configuring 'power' and 'submitqueues'
Writing 'power' and 'submit_queues' concurrently will trigger kernel panic:
Test script:
modprobe nullblk nrdevices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submitqueues; echo 4 > submitqueues; done & while true; do echo 1 > power; echo 0 > power; done
Test result:
BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:_lockacquire+0x41d/0x28f0 Call Trace: <TASK> lockacquire+0x121/0x450 downwrite+0x5f/0x1d0 simplerecursiveremoval+0x12f/0x5c0 blkmqdebugfsunregisterhctxs+0x7c/0x100 blkmqupdatenrhwqueues+0x4a3/0x720 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicesubmitqueuesstore+0x79/0xf0 [nullblk] configfswriteiter+0x119/0x1e0 vfswrite+0x326/0x730 ksys_write+0x74/0x150
This is because delgendisk() can concurrent with blkmqupdatenrhwqueues():
nullbdevicepowerstore nullbapplysubmitqueues nulldeldev delgendisk nullbupdatenrhwqueues if (!dev->nullb) // still set while gendisk is deleted return 0 blkmqupdatenrhwqueues dev->nullb = NULL
Fix this problem by resuing the global mutex to protect nullbdevicepowerstore() and nullbupdatenrhw_queues() from configfs.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"232983569741975712159464759549992331625",
"148552933297552796959740629680096613639",
"186630623061854820499895055818517080333",
"178385248693088244280437500741420580728",
"147245820605971813112547937933592059774",
"279983263795343791290785766891111509618",
"33335469485339307456422323015451161415",
"256477621805585766621700766518830779208",
"116098727426780768041420843178144067337",
"150987395509307260035105705728951256178",
"141347805120878512641096473382207201268",
"158519702646364662397895775223753036540",
"206361728501062316766743844311065952166",
"93424413184974374201544962489815294657",
"7215411753552124586451585780954860693",
"212184908099625808104552439026127112026",
"222236190822428382537816212570136720902",
"114601467760034419723993574808553046107",
"162087916835179157278790874866863824901",
"210835124850794417232001942525500397060",
"249771787187914062870198203689004118645",
"268997110538886978207876466575479447546",
"212739450061425436159474312036085171928",
"327987750106866380791698140003394601414",
"77193615212064315952248506989734994124",
"337304649127791978239995146208689470027",
"277429519932244792211266867386900467234",
"120295477508401533502400917160314731477",
"279199987474779528180330188254479988142",
"55476199440433636558621746198303336816",
"128150339031878609984418035844106984574",
"113491855117160875216812073980288564257",
"81452508795627167890434095770396960415",
"126304246381899920570193890501565777382",
"179648946590446183358907597307513999627",
"198958651338068320206751913768101735493",
"51424377389623868852151437096061374176",
"256662768481529203710409420395379872498",
"220429205898167402544297724968190697555",
"241537424037253495662888680037584458838",
"292580587865641018928513912382702168048",
"212239841283359367830117954834846520011",
"221228234681932091750298458410708767743",
"336391919872906257527803672431918344640",
"211030396060278392726961512616558572415",
"131285668351953447280584909627226280737",
"87696575387349415649506567267044896675",
"327587550427624648066152903293410258418",
"175046038362395375585790095277453831434",
"279101508497893280901054889415272387472",
"181953183225114019734758937139757323541",
"199894206267478627369250763156440518520",
"165602722946629255449517432622716729997",
"193633061822345001030559835111520396635"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/null_blk/main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-082d5af0"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"232983569741975712159464759549992331625",
"148552933297552796959740629680096613639",
"186630623061854820499895055818517080333",
"178385248693088244280437500741420580728",
"147245820605971813112547937933592059774",
"279983263795343791290785766891111509618",
"33335469485339307456422323015451161415",
"256477621805585766621700766518830779208",
"116098727426780768041420843178144067337",
"150987395509307260035105705728951256178",
"141347805120878512641096473382207201268",
"158519702646364662397895775223753036540",
"206361728501062316766743844311065952166",
"93424413184974374201544962489815294657",
"7215411753552124586451585780954860693",
"212184908099625808104552439026127112026",
"222236190822428382537816212570136720902",
"114601467760034419723993574808553046107",
"162087916835179157278790874866863824901",
"210835124850794417232001942525500397060",
"249771787187914062870198203689004118645",
"268997110538886978207876466575479447546",
"212739450061425436159474312036085171928",
"327987750106866380791698140003394601414",
"77193615212064315952248506989734994124",
"337304649127791978239995146208689470027",
"277429519932244792211266867386900467234",
"120295477508401533502400917160314731477",
"279199987474779528180330188254479988142",
"55476199440433636558621746198303336816",
"128150339031878609984418035844106984574",
"113491855117160875216812073980288564257",
"81452508795627167890434095770396960415",
"126304246381899920570193890501565777382",
"179648946590446183358907597307513999627",
"198958651338068320206751913768101735493",
"229685657279192344167168050005101873778",
"289339521982162201980352144872906248740",
"188686014357769059944746155028796378502",
"104185467170539790552441551991618826387",
"292580587865641018928513912382702168048",
"235585216712525459869737057895346083328",
"278383455488187337625585824557855446650",
"119979765090371054890947672141810288087",
"56083986929188274248563984106573120167",
"131285668351953447280584909627226280737",
"87696575387349415649506567267044896675",
"327587550427624648066152903293410258418",
"175046038362395375585790095277453831434",
"279101508497893280901054889415272387472",
"181953183225114019734758937139757323541",
"199894206267478627369250763156440518520",
"165602722946629255449517432622716729997",
"193633061822345001030559835111520396635"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/null_blk/main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-0bc8ef1b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 755.0,
"function_hash": "204675466725009202780805435634832186860"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_device_power_store"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-0eadde57"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 755.0,
"function_hash": "204675466725009202780805435634832186860"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_device_power_store"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-109168ca"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 127.0,
"function_hash": "99930156965785617790595814761510869411"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_poll_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-1aaa272c"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 127.0,
"function_hash": "99930156965785617790595814761510869411"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_poll_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-373047c9"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2845.0,
"function_hash": "329221297331731855574355213891255002605"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_add_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-3bf0d265"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"232983569741975712159464759549992331625",
"148552933297552796959740629680096613639",
"186630623061854820499895055818517080333",
"178385248693088244280437500741420580728",
"147245820605971813112547937933592059774",
"279983263795343791290785766891111509618",
"33335469485339307456422323015451161415",
"256477621805585766621700766518830779208",
"116098727426780768041420843178144067337",
"150987395509307260035105705728951256178",
"141347805120878512641096473382207201268",
"158519702646364662397895775223753036540",
"206361728501062316766743844311065952166",
"93424413184974374201544962489815294657",
"7215411753552124586451585780954860693",
"212184908099625808104552439026127112026",
"222236190822428382537816212570136720902",
"114601467760034419723993574808553046107",
"162087916835179157278790874866863824901",
"210835124850794417232001942525500397060",
"249771787187914062870198203689004118645",
"268997110538886978207876466575479447546",
"212739450061425436159474312036085171928",
"327987750106866380791698140003394601414",
"77193615212064315952248506989734994124",
"337304649127791978239995146208689470027",
"277429519932244792211266867386900467234",
"120295477508401533502400917160314731477",
"279199987474779528180330188254479988142",
"55476199440433636558621746198303336816",
"128150339031878609984418035844106984574",
"113491855117160875216812073980288564257",
"39448425999606555516386147458634502628",
"288304607513012023465979732791922514801",
"160056154977219709121131451915707757160",
"198958651338068320206751913768101735493",
"51424377389623868852151437096061374176",
"256662768481529203710409420395379872498",
"220429205898167402544297724968190697555",
"241537424037253495662888680037584458838",
"292580587865641018928513912382702168048",
"212239841283359367830117954834846520011",
"221228234681932091750298458410708767743",
"336391919872906257527803672431918344640",
"211030396060278392726961512616558572415",
"131285668351953447280584909627226280737",
"87696575387349415649506567267044896675",
"327587550427624648066152903293410258418",
"175046038362395375585790095277453831434",
"279101508497893280901054889415272387472",
"181953183225114019734758937139757323541",
"199894206267478627369250763156440518520",
"165602722946629255449517432622716729997",
"193633061822345001030559835111520396635"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/null_blk/main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-44cc720d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2773.0,
"function_hash": "277406889478828556483018049138693794385"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_add_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-4dcccb88"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 127.0,
"function_hash": "99930156965785617790595814761510869411"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_poll_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-6d1ef2d8"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 196.0,
"function_hash": "178090760703016267025401913910070920822"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_create_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-7678eae2"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 125.0,
"function_hash": "279330990577565015442120677977230967058"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_submit_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-8bb371bf"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 755.0,
"function_hash": "204675466725009202780805435634832186860"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_device_power_store"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-a0879f2f"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 196.0,
"function_hash": "178090760703016267025401913910070920822"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_create_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-ac7b1c07"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 196.0,
"function_hash": "178090760703016267025401913910070920822"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_create_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9",
"signature_version": "v1",
"id": "CVE-2024-36478-afe69f83"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 125.0,
"function_hash": "279330990577565015442120677977230967058"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_submit_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16",
"signature_version": "v1",
"id": "CVE-2024-36478-c67b5b1a"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2716.0,
"function_hash": "41507040514765335295070050708701242551"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "null_add_dev"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-d34c35c8"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 125.0,
"function_hash": "279330990577565015442120677977230967058"
},
"target": {
"file": "drivers/block/null_blk/main.c",
"function": "nullb_apply_submit_queues"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0495473ee4c1d041b5a917f10446a22c047f47",
"signature_version": "v1",
"id": "CVE-2024-36478-ee033202"
}
]