In the Linux kernel, the following vulnerability has been resolved:
nullblk: fix null-ptr-dereference while configuring 'power' and 'submitqueues'
Writing 'power' and 'submit_queues' concurrently will trigger kernel panic:
Test script:
modprobe nullblk nrdevices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submitqueues; echo 4 > submitqueues; done & while true; do echo 1 > power; echo 0 > power; done
Test result:
BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:_lockacquire+0x41d/0x28f0 Call Trace: <TASK> lockacquire+0x121/0x450 downwrite+0x5f/0x1d0 simplerecursiveremoval+0x12f/0x5c0 blkmqdebugfsunregisterhctxs+0x7c/0x100 blkmqupdatenrhwqueues+0x4a3/0x720 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicesubmitqueuesstore+0x79/0xf0 [nullblk] configfswriteiter+0x119/0x1e0 vfswrite+0x326/0x730 ksys_write+0x74/0x150
This is because delgendisk() can concurrent with blkmqupdatenrhwqueues():
nullbdevicepowerstore nullbapplysubmitqueues nulldeldev delgendisk nullbupdatenrhwqueues if (!dev->nullb) // still set while gendisk is deleted return 0 blkmqupdatenrhwqueues dev->nullb = NULL
Fix this problem by resuing the global mutex to protect nullbdevicepowerstore() and nullbupdatenrhw_queues() from configfs.
{ "vanir_signatures": [ { "id": "CVE-2024-36478-0802a28f", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_device_power_store" }, "deprecated": false, "digest": { "length": 755.0, "function_hash": "204675466725009202780805435634832186860" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" }, { "id": "CVE-2024-36478-082d5af0", "signature_type": "Line", "target": { "file": "drivers/block/null_blk/main.c" }, "deprecated": false, "digest": { "line_hashes": [ "232983569741975712159464759549992331625", "148552933297552796959740629680096613639", "186630623061854820499895055818517080333", "178385248693088244280437500741420580728", "147245820605971813112547937933592059774", "279983263795343791290785766891111509618", "33335469485339307456422323015451161415", "256477621805585766621700766518830779208", "116098727426780768041420843178144067337", "150987395509307260035105705728951256178", "141347805120878512641096473382207201268", "158519702646364662397895775223753036540", "206361728501062316766743844311065952166", "93424413184974374201544962489815294657", "7215411753552124586451585780954860693", "212184908099625808104552439026127112026", "222236190822428382537816212570136720902", "114601467760034419723993574808553046107", "162087916835179157278790874866863824901", "210835124850794417232001942525500397060", "249771787187914062870198203689004118645", "268997110538886978207876466575479447546", "212739450061425436159474312036085171928", "327987750106866380791698140003394601414", "77193615212064315952248506989734994124", "337304649127791978239995146208689470027", "277429519932244792211266867386900467234", "120295477508401533502400917160314731477", "279199987474779528180330188254479988142", "55476199440433636558621746198303336816", "128150339031878609984418035844106984574", "113491855117160875216812073980288564257", "81452508795627167890434095770396960415", "126304246381899920570193890501565777382", "179648946590446183358907597307513999627", "198958651338068320206751913768101735493", "51424377389623868852151437096061374176", "256662768481529203710409420395379872498", "220429205898167402544297724968190697555", "241537424037253495662888680037584458838", "292580587865641018928513912382702168048", "212239841283359367830117954834846520011", "221228234681932091750298458410708767743", "336391919872906257527803672431918344640", "211030396060278392726961512616558572415", "131285668351953447280584909627226280737", "87696575387349415649506567267044896675", "327587550427624648066152903293410258418", "175046038362395375585790095277453831434", "279101508497893280901054889415272387472", "181953183225114019734758937139757323541", "199894206267478627369250763156440518520", "165602722946629255449517432622716729997", "193633061822345001030559835111520396635" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-0d5d52c6", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_create_dev" }, "deprecated": false, "digest": { "length": 196.0, "function_hash": "178090760703016267025401913910070920822" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" }, { "id": "CVE-2024-36478-109168ca", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_device_power_store" }, "deprecated": false, "digest": { "length": 755.0, "function_hash": "204675466725009202780805435634832186860" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-346ef1b0", "signature_type": "Line", "target": { "file": "drivers/block/null_blk/main.c" }, "deprecated": false, "digest": { "line_hashes": [ "232983569741975712159464759549992331625", "148552933297552796959740629680096613639", "186630623061854820499895055818517080333", "178385248693088244280437500741420580728", "147245820605971813112547937933592059774", "279983263795343791290785766891111509618", "33335469485339307456422323015451161415", "256477621805585766621700766518830779208", "116098727426780768041420843178144067337", "150987395509307260035105705728951256178", "141347805120878512641096473382207201268", "158519702646364662397895775223753036540", "206361728501062316766743844311065952166", "93424413184974374201544962489815294657", "7215411753552124586451585780954860693", "212184908099625808104552439026127112026", "222236190822428382537816212570136720902", "114601467760034419723993574808553046107", "162087916835179157278790874866863824901", "210835124850794417232001942525500397060", "249771787187914062870198203689004118645", "268997110538886978207876466575479447546", "212739450061425436159474312036085171928", "327987750106866380791698140003394601414", "77193615212064315952248506989734994124", "337304649127791978239995146208689470027", "277429519932244792211266867386900467234", "120295477508401533502400917160314731477", "279199987474779528180330188254479988142", "55476199440433636558621746198303336816", "128150339031878609984418035844106984574", "113491855117160875216812073980288564257", "81452508795627167890434095770396960415", "126304246381899920570193890501565777382", "179648946590446183358907597307513999627", "198958651338068320206751913768101735493", "229685657279192344167168050005101873778", "289339521982162201980352144872906248740", "188686014357769059944746155028796378502", "104185467170539790552441551991618826387", "292580587865641018928513912382702168048", "235585216712525459869737057895346083328", "278383455488187337625585824557855446650", "119979765090371054890947672141810288087", "56083986929188274248563984106573120167", "131285668351953447280584909627226280737", "87696575387349415649506567267044896675", "327587550427624648066152903293410258418", "175046038362395375585790095277453831434", "279101508497893280901054889415272387472", "181953183225114019734758937139757323541", "199894206267478627369250763156440518520", "165602722946629255449517432622716729997", "193633061822345001030559835111520396635" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" }, { "id": "CVE-2024-36478-373047c9", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_poll_queues" }, "deprecated": false, "digest": { "length": 127.0, "function_hash": "99930156965785617790595814761510869411" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-3bf0d265", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_add_dev" }, "deprecated": false, "digest": { "length": 2845.0, "function_hash": "329221297331731855574355213891255002605" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-44cc720d", "signature_type": "Line", "target": { "file": "drivers/block/null_blk/main.c" }, "deprecated": false, "digest": { "line_hashes": [ "232983569741975712159464759549992331625", "148552933297552796959740629680096613639", "186630623061854820499895055818517080333", "178385248693088244280437500741420580728", "147245820605971813112547937933592059774", "279983263795343791290785766891111509618", "33335469485339307456422323015451161415", "256477621805585766621700766518830779208", "116098727426780768041420843178144067337", "150987395509307260035105705728951256178", "141347805120878512641096473382207201268", "158519702646364662397895775223753036540", "206361728501062316766743844311065952166", "93424413184974374201544962489815294657", "7215411753552124586451585780954860693", "212184908099625808104552439026127112026", "222236190822428382537816212570136720902", "114601467760034419723993574808553046107", "162087916835179157278790874866863824901", "210835124850794417232001942525500397060", "249771787187914062870198203689004118645", "268997110538886978207876466575479447546", "212739450061425436159474312036085171928", "327987750106866380791698140003394601414", "77193615212064315952248506989734994124", "337304649127791978239995146208689470027", "277429519932244792211266867386900467234", "120295477508401533502400917160314731477", "279199987474779528180330188254479988142", "55476199440433636558621746198303336816", "128150339031878609984418035844106984574", "113491855117160875216812073980288564257", "39448425999606555516386147458634502628", "288304607513012023465979732791922514801", "160056154977219709121131451915707757160", "198958651338068320206751913768101735493", "51424377389623868852151437096061374176", "256662768481529203710409420395379872498", "220429205898167402544297724968190697555", "241537424037253495662888680037584458838", "292580587865641018928513912382702168048", "212239841283359367830117954834846520011", "221228234681932091750298458410708767743", "336391919872906257527803672431918344640", "211030396060278392726961512616558572415", "131285668351953447280584909627226280737", "87696575387349415649506567267044896675", "327587550427624648066152903293410258418", "175046038362395375585790095277453831434", "279101508497893280901054889415272387472", "181953183225114019734758937139757323541", "199894206267478627369250763156440518520", "165602722946629255449517432622716729997", "193633061822345001030559835111520396635" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-4dcccb88", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_add_dev" }, "deprecated": false, "digest": { "length": 2773.0, "function_hash": "277406889478828556483018049138693794385" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-660314f9", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_poll_queues" }, "deprecated": false, "digest": { "length": 127.0, "function_hash": "99930156965785617790595814761510869411" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" }, { "id": "CVE-2024-36478-6d1ef2d8", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_poll_queues" }, "deprecated": false, "digest": { "length": 127.0, "function_hash": "99930156965785617790595814761510869411" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-8bb371bf", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_submit_queues" }, "deprecated": false, "digest": { "length": 125.0, "function_hash": "279330990577565015442120677977230967058" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-a0879f2f", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_device_power_store" }, "deprecated": false, "digest": { "length": 755.0, "function_hash": "204675466725009202780805435634832186860" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-ac7b1c07", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_create_dev" }, "deprecated": false, "digest": { "length": 196.0, "function_hash": "178090760703016267025401913910070920822" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-afe69f83", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_create_dev" }, "deprecated": false, "digest": { "length": 196.0, "function_hash": "178090760703016267025401913910070920822" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadb755f2d684f715a6eb85cb7243aa0c67dfa9" }, { "id": "CVE-2024-36478-bef86c68", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "null_add_dev" }, "deprecated": false, "digest": { "length": 2724.0, "function_hash": "48322059944869761415791431406135421362" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" }, { "id": "CVE-2024-36478-c67b5b1a", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_submit_queues" }, "deprecated": false, "digest": { "length": 125.0, "function_hash": "279330990577565015442120677977230967058" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" }, { "id": "CVE-2024-36478-fa32df4e", "signature_type": "Function", "target": { "file": "drivers/block/null_blk/main.c", "function": "nullb_apply_submit_queues" }, "deprecated": false, "digest": { "length": 125.0, "function_hash": "279330990577565015442120677977230967058" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2db328b0839312c169eb42746ec46fc1ab53ed2" } ] }