In the Linux kernel, the following vulnerability has been resolved:
quota: flush quotareleasework upon quota writeback
One of the paths quota writeback is called from is:
freezesuper() syncfilesystem() ext4syncfs() dquotwritebackdquots()
Since we currently don't always flush the quotareleasework queue in this path, we can end up with the following race:
Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state:
ext4journalcheckstart+0x28/0x110 [ext4] (unreliable) _ext4journalstartsb+0x64/0x1c0 [ext4] ext4releasedquot+0x90/0x1d0 [ext4] quotarelease_workfn+0x43c/0x4d0
Which is the following line:
WARNON(sb->swriters.frozen == SBFREEZECOMPLETE);
Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores.
To avoid this, make sure to flush the workqueue during dquotwritebackdquots() so we dont have any pending workitems after freeze.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-087d7273",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcacb52a985f1b6d280f698a470b873dfe52728a",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-39ede219",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5abba5e0e586e258ded3e798fe5f69c66fec198",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-45485d8b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-4ba479d0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcacb52a985f1b6d280f698a470b873dfe52728a",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-4eab4b26",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f3821acd7c3143145999248087de5fb4b48cf26",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-6365d5e0",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5abba5e0e586e258ded3e798fe5f69c66fec198",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-644e3bfe",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f3821acd7c3143145999248087de5fb4b48cf26",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-662135d2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-87b9e4b8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-89ce0388",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-8a968039",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ea87e34792258825d290f4dc5216276e91cb224",
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-8bd16f1b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ea87e34792258825d290f4dc5216276e91cb224",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "19372752420320275010320312945573430662",
"length": 1135.0
},
"id": "CVE-2024-56780-9e4fcee1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac6f420291b3fee1113f21d612fa88b628afab5b",
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_writeback_dquots"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112627378855442081632074096492215937992",
"301476174202173782768195767684287294132",
"135908749051521653814492889208049345871"
]
},
"id": "CVE-2024-56780-fd07f28b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac6f420291b3fee1113f21d612fa88b628afab5b",
"target": {
"file": "fs/quota/dquot.c"
}
}
]