Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20 | | but task is already holding lock: | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v] | | which lock already depends on the new lock. A simple reproducer is: | #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0902b469bd25065aa0688c3cee6f11744c817e7c to < 5493d84a40f0e61da74e1b0db640845997836b4eaffected0902b469bd25065aa0688c3cee6f11744c817e7c to < 8c2c8445cda8f59c38dec7dc10509bcb23ae26a0affected0902b469bd25065aa0688c3cee6f11744c817e7c to < 45fe76573a2557f632e248cc141342233f422b9aaffected0902b469bd25065aa0688c3cee6f11744c817e7c to < f36b01994d68ffc253c8296e2228dfe6e6431c03affected
Linux Linux
Default version status: affected
2.6.36affected0 to < 2.6.36unaffected6.1.191 to ≤ 6.1.*unaffected6.6.67 to ≤ 6.6.*unaffected6.12.6 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected