Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
81c1188905f88b77743d1fdeeedfc8cb7b67787d to < b5dae1cd0d8368b4338430ff93403df67f0b8bccaffectedbfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a to < 083b58373463a6e5ee60ecb135269348f68ad7dfaffectedf1c006f1c6850c14040f8337753a63119bba39b9 to < 1a267295b1ea6a6477963f3fda84adfecd48fcadaffectedf1c006f1c6850c14040f8337753a63119bba39b9 to < 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410daffectedf1c006f1c6850c14040f8337753a63119bba39b9 to < 3d8c3da95c75a4d312e272fc7b4076dd3ba9115caffectedf1c006f1c6850c14040f8337753a63119bba39b9 to < d8c872901e6459339374e9eea80aa919176c2ccdaffectedf1c006f1c6850c14040f8337753a63119bba39b9 to < 5e9220389920f33b6a804d50c548cd0cd1b04634affected6.1.16 to < 6.1.17affected6.2.3 to < 6.2.4affected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.1.17 to ≤ 6.1.*unaffected6.2.4 to ≤ 6.2.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc ↗
- https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df ↗
- https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad ↗
- https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d ↗
- https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c ↗
- https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd ↗
- https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634 ↗