Description
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to < 3868476cd39161f18720582df17a1b621e805b5daffecteded754e5deeb17f4e675c84e4b6c640cc7344e498 to < 0d4735418512ef825176726eaaa8bd6a35f6b46daffecteded754e5deeb17f4e675c84e4b6c640cc7344e498 to < d663944dbad81bb0e3635d7090db4713e6300858affecteded754e5deeb17f4e675c84e4b6c640cc7344e498 to < 76023560d60f10b4f808941163aa2975f1631683affecteded754e5deeb17f4e675c84e4b6c640cc7344e498 to < ef248d5de4469fb6bbaf8dbe0c4c47800080d648affected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected6.6.160 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d ↗
- https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d ↗
- https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858 ↗
- https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683 ↗
- https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648 ↗