In the Linux kernel, the following vulnerability has been resolved:
ext4: fix access to uninitialised lock in fc replay path
The following kernel trace can be triggered with fstest generic/629 when executed against a filesystem with fast-commit feature enabled:
INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x66/0x90 registerlockclass+0x759/0x7d0 _lockacquire+0x85/0x2630 ? _findgetblock+0xb4/0x380 lockacquire+0xd1/0x2d0 ? _ext4journalgetwriteaccess+0xd5/0x160 _rawspinlock+0x33/0x40 ? _ext4journalgetwriteaccess+0xd5/0x160 _ext4journalgetwriteaccess+0xd5/0x160 ext4reserveinodewrite+0x61/0xb0 _ext4markinodedirty+0x79/0x270 ? ext4extreplaysetiblocks+0x2f8/0x450 ext4extreplaysetiblocks+0x330/0x450 ext4fcreplay+0x14c8/0x1540 ? jread+0x88/0x2e0 ? rcuiswatching+0x11/0x40 doonepass+0x447/0xd00 jbd2journalrecover+0x139/0x1b0 jbd2journalload+0x96/0x390 ext4loadandinitjournal+0x253/0xd40 ext4fillsuper+0x2cc6/0x3180 ...
In the replay path there's an attempt to lock sbi->sbdevwblock in function ext4checkbdevwriteerror(). Unfortunately, at this point this spinlock has not been initialized yet. Moving it's initialization to an earlier point in _ext4fillsuper() fixes this splat.
[
{
"id": "CVE-2024-50014-15f67635",
"signature_version": "v1",
"digest": {
"length": 10541.0,
"function_hash": "152220539851333812158773570032970511844"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23dfdb56581ad92a9967bcd720c8c23356af74c1",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
}
},
{
"id": "CVE-2024-50014-4a54a43b",
"signature_version": "v1",
"digest": {
"length": 14666.0,
"function_hash": "308648703223141487937400098163169946097"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13ea9547763a0488a90ff37cdf52ec85e36ea344",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
}
},
{
"id": "CVE-2024-50014-519c783d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239065617124792120967514630910378496616",
"270852639455217842008684694619947366439",
"262225247202447221985502225287360313901",
"303364177654799499463921581230916973117",
"162282253384503956396064722229114542329",
"67156601078074261455336016612508194606",
"50235864489992684899301858793327208615"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13ea9547763a0488a90ff37cdf52ec85e36ea344",
"target": {
"file": "fs/ext4/super.c"
}
},
{
"id": "CVE-2024-50014-748fc7a7",
"signature_version": "v1",
"digest": {
"length": 10440.0,
"function_hash": "289921782320189543610861923919316258255"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e35f560daebe40264c95e9a1ab03110d4997df6",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
}
},
{
"id": "CVE-2024-50014-906ee373",
"signature_version": "v1",
"digest": {
"length": 10479.0,
"function_hash": "287934453211408334619094185353953366020"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d157fc20ca5239fd56965a5a8aa1a0e25919891a",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
}
},
{
"id": "CVE-2024-50014-9db28ae0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239065617124792120967514630910378496616",
"270852639455217842008684694619947366439",
"262225247202447221985502225287360313901",
"86299489909145947052817363038886909633",
"162282253384503956396064722229114542329",
"67156601078074261455336016612508194606",
"329388486041572368448271257485205660658"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e35f560daebe40264c95e9a1ab03110d4997df6",
"target": {
"file": "fs/ext4/super.c"
}
},
{
"id": "CVE-2024-50014-a8c33a86",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"321862693815630644020220415006966760645",
"270852639455217842008684694619947366439",
"262225247202447221985502225287360313901",
"86299489909145947052817363038886909633",
"292844446134227269663585615671391269499",
"143666284376310092466538706704680064957",
"143307937818863030235787136359201759577"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23dfdb56581ad92a9967bcd720c8c23356af74c1",
"target": {
"file": "fs/ext4/super.c"
}
},
{
"id": "CVE-2024-50014-e528d32c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"321862693815630644020220415006966760645",
"270852639455217842008684694619947366439",
"262225247202447221985502225287360313901",
"86299489909145947052817363038886909633",
"292844446134227269663585615671391269499",
"143666284376310092466538706704680064957",
"143307937818863030235787136359201759577"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d157fc20ca5239fd56965a5a8aa1a0e25919891a",
"target": {
"file": "fs/ext4/super.c"
}
}
]