Description
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
90c60e16401248a4900f3f9387f563d0178dcf34 to < e6cc490048f78b009259a5f032acead9f789c34caffected90c60e16401248a4900f3f9387f563d0178dcf34 to < 239d734c00644072862fa833805c4471573b1445affected90c60e16401248a4900f3f9387f563d0178dcf34 to < bda27fc0b4eb3a425d9a18475c4cb94fbe862c60affected90c60e16401248a4900f3f9387f563d0178dcf34 to < d38135af04a3ad8a585c899d176efc8e97853115affected90c60e16401248a4900f3f9387f563d0178dcf34 to < a89434a6188d8430ea31120da96e3e4cefb58686affected90c60e16401248a4900f3f9387f563d0178dcf34 to < 8147e304d7d32fd5c3e943babc296ce2873dc279affected90c60e16401248a4900f3f9387f563d0178dcf34 to < 558e3275d8a3b101be18a7fe7d1634053e9d9b07affected90c60e16401248a4900f3f9387f563d0178dcf34 to < 4f24a767e3d64a5f58c595b5c29b6063a201f1e3affected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.131 to ≤ 6.6.*unaffected6.12.80 to ≤ 6.12.*unaffected6.18.21 to ≤ 6.18.*unaffected6.19.11 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c ↗
- https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445 ↗
- https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60 ↗
- https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115 ↗
- https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686 ↗
- https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279 ↗
- https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07 ↗
- https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3 ↗