In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix flushing uninitialized delayedwork on cachectr error
An unexpected WARNON from flushwork() may occur when cache creation fails, caused by destroying the uninitialized delayedwork waker in the error path of cachecreate(). For example, the warning appears on the superblock checksum error.
Reproduce steps:
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 _flushwork+0x5d4/0x890
Fix by pulling out the canceldelayedworksync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dmresume and dmdestroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cachedtr is not changed.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"255249288319752281935434321274828752443",
"25610746178821444926260102407813189218",
"94128677207811166401995608488055881467",
"319655235657044019505098391429046403403",
"17143070526139018029637022614702844527",
"246008566798669195784480460199372324708",
"216284031528342261886849511278389230528",
"265747884355036969872529957039081650223",
"118090367516842609345251319906578152894",
"155694675356039625121997699890614413376",
"215042148308750385586131125886831403138",
"245304836235636874151753573507981899475",
"307827832754731475971691516634852340055",
"315362707328273388232315185042306558051",
"91193715576967119104880483618919631660",
"179285141239942166388169192058431254668",
"239483801933491755803190107544129438016",
"77679337508210031588138418826942313004",
"331123908963425637046174533160829229060",
"66685271453029609342573917434250731042",
"114662921787036366693443053689184692213",
"264619723783098254765544488451674631061",
"247011866109559557204253718282314385217",
"92265424001728585179153786961644282961",
"272274055037525950415571408587552429891",
"288521527887470331923527986409180129264"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a754d3c771280f2d06bf8ab716d6a0d36ca256e",
"signature_version": "v1",
"id": "CVE-2024-50280-0faf30da"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 937.0,
"function_hash": "283524152382397575205844901961155022803"
},
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee3ecda73ce13af7c3e556383342b57e6bd0718",
"signature_version": "v1",
"id": "CVE-2024-50280-203d502d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"255249288319752281935434321274828752443",
"25610746178821444926260102407813189218",
"220872287948963931355268107572098838050",
"319230542610045336288079158342566569816",
"6834824610166903300115279816279224293",
"249092538811356023318521566319185836409",
"216284031528342261886849511278389230528",
"265747884355036969872529957039081650223",
"118090367516842609345251319906578152894",
"155694675356039625121997699890614413376",
"215042148308750385586131125886831403138",
"245304836235636874151753573507981899475",
"307827832754731475971691516634852340055",
"315362707328273388232315185042306558051",
"91193715576967119104880483618919631660",
"179285141239942166388169192058431254668",
"239483801933491755803190107544129438016",
"77679337508210031588138418826942313004",
"331123908963425637046174533160829229060",
"66685271453029609342573917434250731042",
"114662921787036366693443053689184692213",
"264619723783098254765544488451674631061",
"247011866109559557204253718282314385217",
"92265424001728585179153786961644282961",
"272274055037525950415571408587552429891",
"288521527887470331923527986409180129264"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d154b333a5667b6c1b213a11a41ad7aaccd10c3d",
"signature_version": "v1",
"id": "CVE-2024-50280-3a5c1b0b"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"255249288319752281935434321274828752443",
"25610746178821444926260102407813189218",
"94128677207811166401995608488055881467",
"319655235657044019505098391429046403403",
"17143070526139018029637022614702844527",
"246008566798669195784480460199372324708",
"216284031528342261886849511278389230528",
"265747884355036969872529957039081650223",
"118090367516842609345251319906578152894",
"155694675356039625121997699890614413376",
"215042148308750385586131125886831403138",
"245304836235636874151753573507981899475",
"307827832754731475971691516634852340055",
"315362707328273388232315185042306558051",
"91193715576967119104880483618919631660",
"179285141239942166388169192058431254668",
"239483801933491755803190107544129438016",
"77679337508210031588138418826942313004",
"331123908963425637046174533160829229060",
"66685271453029609342573917434250731042",
"114662921787036366693443053689184692213",
"264619723783098254765544488451674631061",
"247011866109559557204253718282314385217",
"92265424001728585179153786961644282961",
"272274055037525950415571408587552429891",
"288521527887470331923527986409180129264"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cc12dab635333c4ea28e72d7b947be7d0543c2c",
"signature_version": "v1",
"id": "CVE-2024-50280-674171f1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 937.0,
"function_hash": "283524152382397575205844901961155022803"
},
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d154b333a5667b6c1b213a11a41ad7aaccd10c3d",
"signature_version": "v1",
"id": "CVE-2024-50280-78ee5798"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 937.0,
"function_hash": "283524152382397575205844901961155022803"
},
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a754d3c771280f2d06bf8ab716d6a0d36ca256e",
"signature_version": "v1",
"id": "CVE-2024-50280-8ce00879"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"255249288319752281935434321274828752443",
"25610746178821444926260102407813189218",
"94128677207811166401995608488055881467",
"319655235657044019505098391429046403403",
"17143070526139018029637022614702844527",
"246008566798669195784480460199372324708",
"216284031528342261886849511278389230528",
"265747884355036969872529957039081650223",
"118090367516842609345251319906578152894",
"155694675356039625121997699890614413376",
"215042148308750385586131125886831403138",
"245304836235636874151753573507981899475",
"307827832754731475971691516634852340055",
"315362707328273388232315185042306558051",
"91193715576967119104880483618919631660",
"179285141239942166388169192058431254668",
"239483801933491755803190107544129438016",
"77679337508210031588138418826942313004",
"331123908963425637046174533160829229060",
"66685271453029609342573917434250731042",
"114662921787036366693443053689184692213",
"264619723783098254765544488451674631061",
"247011866109559557204253718282314385217",
"92265424001728585179153786961644282961",
"272274055037525950415571408587552429891",
"288521527887470331923527986409180129264"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135496c208ba26fd68cdef10b64ed7a91ac9a7ff",
"signature_version": "v1",
"id": "CVE-2024-50280-a96b7cae"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 937.0,
"function_hash": "283524152382397575205844901961155022803"
},
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135496c208ba26fd68cdef10b64ed7a91ac9a7ff",
"signature_version": "v1",
"id": "CVE-2024-50280-cb465fea"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"255249288319752281935434321274828752443",
"25610746178821444926260102407813189218",
"94128677207811166401995608488055881467",
"319655235657044019505098391429046403403",
"17143070526139018029637022614702844527",
"246008566798669195784480460199372324708",
"216284031528342261886849511278389230528",
"265747884355036969872529957039081650223",
"118090367516842609345251319906578152894",
"155694675356039625121997699890614413376",
"215042148308750385586131125886831403138",
"245304836235636874151753573507981899475",
"307827832754731475971691516634852340055",
"315362707328273388232315185042306558051",
"91193715576967119104880483618919631660",
"179285141239942166388169192058431254668",
"239483801933491755803190107544129438016",
"77679337508210031588138418826942313004",
"331123908963425637046174533160829229060",
"66685271453029609342573917434250731042",
"114662921787036366693443053689184692213",
"264619723783098254765544488451674631061",
"247011866109559557204253718282314385217",
"92265424001728585179153786961644282961",
"272274055037525950415571408587552429891",
"288521527887470331923527986409180129264"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee3ecda73ce13af7c3e556383342b57e6bd0718",
"signature_version": "v1",
"id": "CVE-2024-50280-cd81cc74"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 937.0,
"function_hash": "283524152382397575205844901961155022803"
},
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cc12dab635333c4ea28e72d7b947be7d0543c2c",
"signature_version": "v1",
"id": "CVE-2024-50280-fa6b56ce"
}
]