In the Linux kernel, the following vulnerability has been resolved:
md: Don't register sync_thread for reshape directly
Currently, if reshape is interrupted, then reassemble the array will register syncthread directly from pers->run(), in this case 'MDRECOVERYRUNNING' is set directly, however, there is no guarantee that mddosync() will be executed, hence stopsyncthread() will hang because 'MDRECOVERY_RUNNING' can't be cleared.
Last patch make sure that mddosync() will set MDRECOVERYDONE, however, following hang can still be triggered by dm-raid test shell/lvconvert-raid-reshape.sh occasionally:
[root@fedora ~]# cat /proc/1982/stack [<0>] stopsyncthread+0x1ab/0x270 [mdmod] [<0>] mdfrozensyncthread+0x5c/0xa0 [mdmod] [<0>] raidpresuspend+0x1e/0x70 [dmraid] [<0>] dmtablepresuspendtargets+0x40/0xb0 [dmmod] [<0>] _dmdestroy+0x2a5/0x310 [dmmod] [<0>] dmdestroy+0x16/0x30 [dmmod] [<0>] devremove+0x165/0x290 [dmmod] [<0>] ctlioctl+0x4bb/0x7b0 [dmmod] [<0>] dmctlioctl+0x11/0x20 [dmmod] [<0>] vfsioctl+0x21/0x60 [<0>] _x64sysioctl+0xb9/0xe0 [<0>] dosyscall64+0xc6/0x230 [<0>] entrySYSCALL64after_hwframe+0x6c/0x74
Meanwhile mddev->recovery is: MDRECOVERYRUNNING | MDRECOVERYINTR | MDRECOVERYRESHAPE | MDRECOVERYFROZEN
Fix this problem by remove the code to register syncthread directly from raid10 and raid5. And let mdcheckrecovery() to register syncthread.
{ "vanir_signatures": [ { "signature_type": "Function", "digest": { "length": 4038.0, "function_hash": "3454721875435014458190647491410442140" }, "deprecated": false, "id": "CVE-2024-26756-10a0a858", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "function": "raid10_run", "file": "drivers/md/raid10.c" } }, { "signature_type": "Function", "digest": { "length": 4262.0, "function_hash": "60228642883777520971440097744719903430" }, "deprecated": false, "id": "CVE-2024-26756-29bb1c50", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "function": "raid10_start_reshape", "file": "drivers/md/raid10.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "217618501506012589661222228893462034756", "101514468049239766938519996537041967253", "267226080782932672509363891635269040469", "246754701879443340289261472940648174430", "261455736582979032266942171923212921216", "146953231894942828846490195153842591656", "269951043039188059013061554381864212093", "102976461778769347505145975670234935923", "42224919303821135727184351372590268084", "294411410996092689802835681496179643994", "267226080782932672509363891635269040469", "154549971112392110860986122537969108733", "180436737407009441690218658667251765196", "255130605324756230944841888558973255521", "224071131597167762530543174541876305174", "336083835870843945663653257818299152595", "39351506819808551659831597741207317380", "183559341524460946876946521807716554577", "158238527029818379066196922896783372861", "168641078303903223962993923771637053842" ] }, "deprecated": false, "id": "CVE-2024-26756-2a9b19f6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "file": "drivers/md/raid10.c" } }, { "signature_type": "Function", "digest": { "length": 1354.0, "function_hash": "228703118141452515713256423204825218673" }, "deprecated": false, "id": "CVE-2024-26756-37507880", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "function": "md_start_sync", "file": "drivers/md/md.c" } }, { "signature_type": "Function", "digest": { "length": 1354.0, "function_hash": "228703118141452515713256423204825218673" }, "deprecated": false, "id": "CVE-2024-26756-46a68a02", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "function": "md_start_sync", "file": "drivers/md/md.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "48439009831356329301496066875996637406", "131533517924446055850500975337318396574", "121424910603671395638553977583928612989", "62922202157855278484917054173887066407", "99187538523520141671461957452319425267", "32733474451402462296807524882917295725", "203271099501444124683674102261001509361", "116749073411603739682672682030448378766", "298956539304636769075296792174085009373" ] }, "deprecated": false, "id": "CVE-2024-26756-4c67db7c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "file": "drivers/md/md.c" } }, { "signature_type": "Function", "digest": { "length": 4038.0, "function_hash": "3454721875435014458190647491410442140" }, "deprecated": false, "id": "CVE-2024-26756-4c83c8df", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "function": "raid10_run", "file": "drivers/md/raid10.c" } }, { "signature_type": "Function", "digest": { "length": 7582.0, "function_hash": "154704713292690061072660598766591991444" }, "deprecated": false, "id": "CVE-2024-26756-689f2381", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "function": "raid5_run", "file": "drivers/md/raid5.c" } }, { "signature_type": "Function", "digest": { "length": 4262.0, "function_hash": "60228642883777520971440097744719903430" }, "deprecated": false, "id": "CVE-2024-26756-6c9657b3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "function": "raid10_start_reshape", "file": "drivers/md/raid10.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "217618501506012589661222228893462034756", "101514468049239766938519996537041967253", "267226080782932672509363891635269040469", "246754701879443340289261472940648174430", "330153965484178909513154838211767888637", "2973059655638388412847288432905278755", "98087022871185077506028954849514854292", "21721073862616889215066030987095425195", "42224919303821135727184351372590268084", "294411410996092689802835681496179643994", "267226080782932672509363891635269040469", "154549971112392110860986122537969108733", "228624978898893722048109901461634444318", "249810081324169180522822816558635681489", "211234086907467079166799309893057858928", "87611474279444514999811417883459526453", "233722642662195469683760360809915061458", "244097880257801932046777575987960241717", "214248386910676188079710509811249786760", "25872016348188241126004358619626201012", "192348357699533725421720112121331669991", "174746831578492929173749533185471591547", "61633135914933464071827713989021117775", "306867137438445357751811956716694198020", "304830730021141612874163143621859166411", "127179378887339769407443119424212781993", "9779038496567477656018018404037565814", "41747039803432763991544158928110114991", "326489828331418259043691144759099030823", "208778088340458008094232101846838098687", "1634409652151056616608065455299411024", "183559341524460946876946521807716554577", "158238527029818379066196922896783372861", "249545869133733564366498574704344473735" ] }, "deprecated": false, "id": "CVE-2024-26756-8c0be717", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "file": "drivers/md/raid5.c" } }, { "signature_type": "Function", "digest": { "length": 3465.0, "function_hash": "78253540353084450298940592200915216604" }, "deprecated": false, "id": "CVE-2024-26756-a5e5ac01", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "function": "raid5_start_reshape", "file": "drivers/md/raid5.c" } }, { "signature_type": "Function", "digest": { "length": 3486.0, "function_hash": "143723135206192384741952487552892637908" }, "deprecated": false, "id": "CVE-2024-26756-afdf07f5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "function": "raid5_start_reshape", "file": "drivers/md/raid5.c" } }, { "signature_type": "Function", "digest": { "length": 7293.0, "function_hash": "160549479671487882681384928591006468598" }, "deprecated": false, "id": "CVE-2024-26756-baa57b8a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "function": "raid5_run", "file": "drivers/md/raid5.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "217618501506012589661222228893462034756", "101514468049239766938519996537041967253", "267226080782932672509363891635269040469", "246754701879443340289261472940648174430", "261455736582979032266942171923212921216", "146953231894942828846490195153842591656", "269951043039188059013061554381864212093", "102976461778769347505145975670234935923", "42224919303821135727184351372590268084", "294411410996092689802835681496179643994", "267226080782932672509363891635269040469", "154549971112392110860986122537969108733", "180436737407009441690218658667251765196", "255130605324756230944841888558973255521", "224071131597167762530543174541876305174", "336083835870843945663653257818299152595", "39351506819808551659831597741207317380", "183559341524460946876946521807716554577", "158238527029818379066196922896783372861", "168641078303903223962993923771637053842" ] }, "deprecated": false, "id": "CVE-2024-26756-c6d9aace", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "file": "drivers/md/raid10.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "217618501506012589661222228893462034756", "101514468049239766938519996537041967253", "267226080782932672509363891635269040469", "246754701879443340289261472940648174430", "330153965484178909513154838211767888637", "2973059655638388412847288432905278755", "98087022871185077506028954849514854292", "21721073862616889215066030987095425195", "42224919303821135727184351372590268084", "294411410996092689802835681496179643994", "267226080782932672509363891635269040469", "154549971112392110860986122537969108733", "228624978898893722048109901461634444318", "249810081324169180522822816558635681489", "211234086907467079166799309893057858928", "87611474279444514999811417883459526453", "233722642662195469683760360809915061458", "244097880257801932046777575987960241717", "214248386910676188079710509811249786760", "25872016348188241126004358619626201012", "192348357699533725421720112121331669991", "174746831578492929173749533185471591547", "61633135914933464071827713989021117775", "306867137438445357751811956716694198020", "304830730021141612874163143621859166411", "127179378887339769407443119424212781993", "9779038496567477656018018404037565814", "41747039803432763991544158928110114991", "326489828331418259043691144759099030823", "208778088340458008094232101846838098687", "1634409652151056616608065455299411024", "183559341524460946876946521807716554577", "158238527029818379066196922896783372861", "249545869133733564366498574704344473735" ] }, "deprecated": false, "id": "CVE-2024-26756-ce0b87df", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13b520fb62b772e408f9b79c5fe18ad414e90417", "signature_version": "v1", "target": { "file": "drivers/md/raid5.c" } }, { "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "48439009831356329301496066875996637406", "131533517924446055850500975337318396574", "121424910603671395638553977583928612989", "62922202157855278484917054173887066407", "99187538523520141671461957452319425267", "32733474451402462296807524882917295725", "203271099501444124683674102261001509361", "116749073411603739682672682030448378766", "298956539304636769075296792174085009373" ] }, "deprecated": false, "id": "CVE-2024-26756-e0433b6f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad39c08186f8a0f221337985036ba86731d6aafe", "signature_version": "v1", "target": { "file": "drivers/md/md.c" } } ] }