In the Linux kernel, the following vulnerability has been resolved:
sysv: don't call sbbread() with pointerslock held
syzbot is reporting sleep in atomic context in SysV filesystem [1], for sbbread() is called with rwspinlock held.
A "writelock(&pointerslock) => readlock(&pointerslock) deadlock" bug and a "sbbread() with writelock(&pointers_lock)" bug were introduced by "Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.
Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the former bug by moving pointerslock lock to the callers, but instead introduced a "sbbread() with readlock(&pointerslock)" bug (which made this problem easier to hit).
Al Viro suggested that why not to do like getbranch()/getblock()/ findshared() in Minix filesystem does. And doing like that is almost a revert of "[PATCH] err1-40: sysvfs locking fix" except that getbranch() from with findshared() is called without writelock(&pointers_lock).
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@674c1c4229e743070e09db63a23442950ff000d1", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-12852fc2", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e8524135a3902e7563a5a59b7b5ec1bf4904ac", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-14fb37ef", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@674c1c4229e743070e09db63a23442950ff000d1", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-23207bdf", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f123dc86388cb669c3d6322702dc441abc35c31e", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-2926c950", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69224223746ab96d43e5db9d22d136827b7e2d3", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-2d119841", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f123dc86388cb669c3d6322702dc441abc35c31e", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-3386b3bf", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e8524135a3902e7563a5a59b7b5ec1bf4904ac", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-5547e604", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b33feb2ebddc2b1aa607f553566b18a4af1d76", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-61ce4e30", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd203d2c671bdee9ab77090ff394d3b71b627927", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-6e7b9de9", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd203d2c671bdee9ab77090ff394d3b71b627927", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-7e43a468", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd203d2c671bdee9ab77090ff394d3b71b627927", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-85ab9976", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e8524135a3902e7563a5a59b7b5ec1bf4904ac", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-900ecb87", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@674c1c4229e743070e09db63a23442950ff000d1", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-94698a7e", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69224223746ab96d43e5db9d22d136827b7e2d3", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-a2050219", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69224223746ab96d43e5db9d22d136827b7e2d3", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-bed1956b", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd203d2c671bdee9ab77090ff394d3b71b627927", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-cc9b31da", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e8524135a3902e7563a5a59b7b5ec1bf4904ac", "digest": { "length": 1006.0, "function_hash": "88963550708062848036066933418036453348" }, "id": "CVE-2023-52699-cf427167", "target": { "file": "fs/sysv/itree.c", "function": "get_block" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b33feb2ebddc2b1aa607f553566b18a4af1d76", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-d4ced9dd", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69224223746ab96d43e5db9d22d136827b7e2d3", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-df8289ee", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f123dc86388cb669c3d6322702dc441abc35c31e", "digest": { "length": 721.0, "function_hash": "125252818896527528990815685534318273768" }, "id": "CVE-2023-52699-e035d046", "target": { "file": "fs/sysv/itree.c", "function": "get_branch" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f123dc86388cb669c3d6322702dc441abc35c31e", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-e3c5e48d", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b33feb2ebddc2b1aa607f553566b18a4af1d76", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-ee01a80e", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b33feb2ebddc2b1aa607f553566b18a4af1d76", "digest": { "length": 772.0, "function_hash": "86888936134065782289933708902657365661" }, "id": "CVE-2023-52699-f8ce07fa", "target": { "file": "fs/sysv/itree.c", "function": "find_shared" }, "signature_version": "v1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@674c1c4229e743070e09db63a23442950ff000d1", "digest": { "line_hashes": [ "275202249989550570137678025158106021616", "69757096749023052790708801005908814528", "215062457859110065084608712237322430977", "205769417214361676396955499436922554071", "240888407124306009624795182754534110071", "11719606943402683971998741973009049378", "41105970299854191209295552096407503956", "106999087088061074482767187235664815695", "134859217348379646651760034693048655104", "244288965792296980537675633796561225066", "27959368171987534268894230836287457259", "74949267800366106914674176089638107137", "148471199886406500619492818046833552692", "294744552433049806258167478522540238015", "277813699055689521527291746667814064730", "83244697968254832406728051864219251852", "285860577652065447922553540859453255445", "6326721950501773788985562018369358525", "80965465395660170528508022684524905119", "252011916120421914063269725075148851450", "70313622898900613274603462509116033916", "143487260131978796519165951057236417652", "156219200460199081557618540398798865910", "237192599709285176767748617917973209839", "261758126863522261374024089781495916437", "286787048762162301375362609681508063918", "56266602287464699288870551130202317391" ], "threshold": 0.9 }, "id": "CVE-2023-52699-fb02b0ad", "target": { "file": "fs/sysv/itree.c" }, "signature_version": "v1" } ] }