In the Linux kernel, the following vulnerability has been resolved:
ext4: fix uninitialized ratelimitstate->lock access in _ext4fillsuper()
In the following concurrency we will access the uninitialized rs->lock:
ext4fillsuper ext4registersysfs // sysfs registered msgratelimitintervalms // Other processes modify rs->interval to // non-zero via msgratelimitintervalms ext4orphancleanup ext4msg(sb, KERNINFO, "Errors on filesystem, " ext4msg _ratelimit(&(EXT4SB(sb)->smsgratelimitstate) if (!rs->interval) // do nothing if interval is 0 return 1; rawspintrylockirqsave(&rs->lock, flags) rawspintrylock(lock) rawspintrylock _rawspintrylock spinacquire(&lock->depmap, 0, 1, RETIP) lockacquire _lockacquire registerlockclass assignlockkey dumpstack(); ratelimitstateinit(&sbi->smsgratelimitstate, 5 * HZ, 10); rawspinlock_init(&rs->lock); // init rs->lock here
and get the following dump_stack:
========================================================= INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504 [...] Call Trace: dumpstacklvl+0xc5/0x170 dumpstack+0x18/0x30 registerlockclass+0x740/0x7c0 lockacquire+0x69/0x13a0 lockacquire+0x120/0x450 _rawspintrylock+0x98/0xd0 _ratelimit+0xf6/0x220 _ext4msg+0x7f/0x160 [ext4] ext4orphancleanup+0x665/0x740 [ext4] _ext4fillsuper+0x21ea/0x2b10 [ext4] ext4fillsuper+0x14d/0x360 [ext4]
Normally interval is 0 until smsgratelimitstate is initialized, so _ratelimit() does nothing. But registering sysfs precedes initializing rs->lock, so it is possible to change rs->interval to a non-zero value via the msgratelimitintervalms interface of sysfs while rs->lock is uninitialized, and then a call to ext4_msg triggers the problem by accessing an uninitialized rs->lock. Therefore register sysfs after all initializations are complete to avoid such problems.
{ "vanir_signatures": [ { "id": "CVE-2024-40998-1d348ceb", "signature_type": "Line", "target": { "file": "fs/ext4/super.c" }, "deprecated": false, "digest": { "line_hashes": [ "275755243943720642101011885760375214099", "81812992364313528653283363570746773216", "26251327637055320055482193199322537072", "136985616371897246484925732397207127691", "200110904252530662833251934434526787414", "314486028886884158257795648435155114922", "161554823519353929764196343210986584673", "321241304877386104721838181840036097708", "161201321580832128957948226661181202875", "148954573503641214133753667142283167587", "182249286140291677747389320887460463652", "269679501698281540504827243967797212198", "214829789027939904326543866480832453530", "303364177654799499463921581230916973117", "233656867565181256547561018669787945000", "231804124867747448752315537011686440885", "285441815981257612351405878295693903914", "157650694655354551407361893182299405814", "2093068711729272345781551735862259281", "8071948057008854514747353028685202857", "201286617819412245784215131763732345592", "179302683544659876586501160295902570252", "88622651579574015302012052446264965002", "174138696482647943512150814001161369021", "194120373769503654947149461402861408580", "264963265669306258319991734446484066101", "192718861059312260148403263183407748016", "93946317880478511684762383782372229209", "256440104409346216152525454456934214332" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23afcd52af06880c6c913a0ad99022b8937b575c" }, { "id": "CVE-2024-40998-4cffa3fe", "signature_type": "Function", "target": { "file": "fs/ext4/super.c", "function": "__ext4_fill_super" }, "deprecated": false, "digest": { "length": 10572.0, "function_hash": "90470146997528497735981783219505542766" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23afcd52af06880c6c913a0ad99022b8937b575c" }, { "id": "CVE-2024-40998-9a0a98d5", "signature_type": "Function", "target": { "file": "fs/ext4/super.c", "function": "__ext4_fill_super" }, "deprecated": false, "digest": { "length": 10601.0, "function_hash": "336953603429021093528081444586369151469" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@645267906944a9aeec9d5c56ee24a9096a288798" }, { "id": "CVE-2024-40998-e141d377", "signature_type": "Line", "target": { "file": "fs/ext4/super.c" }, "deprecated": false, "digest": { "line_hashes": [ "275755243943720642101011885760375214099", "81812992364313528653283363570746773216", "26251327637055320055482193199322537072", "136985616371897246484925732397207127691", "200110904252530662833251934434526787414", "314486028886884158257795648435155114922", "161554823519353929764196343210986584673", "321241304877386104721838181840036097708", "161201321580832128957948226661181202875", "148954573503641214133753667142283167587", "182249286140291677747389320887460463652", "269679501698281540504827243967797212198", "214829789027939904326543866480832453530", "303364177654799499463921581230916973117", "233656867565181256547561018669787945000", "231804124867747448752315537011686440885", "285441815981257612351405878295693903914", "157650694655354551407361893182299405814", "2093068711729272345781551735862259281", "8071948057008854514747353028685202857", "201286617819412245784215131763732345592", "179302683544659876586501160295902570252", "88622651579574015302012052446264965002", "174138696482647943512150814001161369021", "194120373769503654947149461402861408580", "264963265669306258319991734446484066101", "192718861059312260148403263183407748016", "93946317880478511684762383782372229209", "256440104409346216152525454456934214332" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@645267906944a9aeec9d5c56ee24a9096a288798" } ] }