CVE-2024-36478
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-36478
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-36478.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-36478
- Downstream
- Related
- Published
- 2024-06-21T10:18:09Z
- Modified
- 2025-10-09T10:25:47.372979Z
- Summary
- null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nullblk: fix null-ptr-dereference while configuring 'power' and 'submitqueues'
Writing 'power' and 'submit_queues' concurrently will trigger kernel panic:
Test script:
modprobe nullblk nrdevices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submitqueues; echo 4 > submitqueues; done & while true; do echo 1 > power; echo 0 > power; done
Test result:
BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:_lockacquire+0x41d/0x28f0 Call Trace: <TASK> lockacquire+0x121/0x450 downwrite+0x5f/0x1d0 simplerecursiveremoval+0x12f/0x5c0 blkmqdebugfsunregisterhctxs+0x7c/0x100 blkmqupdatenrhwqueues+0x4a3/0x720 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicesubmitqueuesstore+0x79/0xf0 [nullblk] configfswriteiter+0x119/0x1e0 vfswrite+0x326/0x730 ksys_write+0x74/0x150
This is because delgendisk() can concurrent with blkmqupdatenrhwqueues():
nullbdevicepowerstore nullbapplysubmitqueues nulldeldev delgendisk nullbupdatenrhwqueues if (!dev->nullb) // still set while gendisk is deleted return 0 blkmqupdatenrhwqueues dev->nullb = NULL
Fix this problem by resuing the global mutex to protect nullbdevicepowerstore() and nullbupdatenrhw_queues() from configfs.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1d4c8baef435c98e8d5aa7027dc5a9f70834ba16
- https://git.kernel.org/stable/c/5d0495473ee4c1d041b5a917f10446a22c047f47
- https://git.kernel.org/stable/c/a2db328b0839312c169eb42746ec46fc1ab53ed2
- https://git.kernel.org/stable/c/aaadb755f2d684f715a6eb85cb7243aa0c67dfa9
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced45919fbfe1c487c17ea1d198534339a5e8abeae3Fixed1d4c8baef435c98e8d5aa7027dc5a9f70834ba16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced45919fbfe1c487c17ea1d198534339a5e8abeae3Fixedaaadb755f2d684f715a6eb85cb7243aa0c67dfa9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced45919fbfe1c487c17ea1d198534339a5e8abeae3Fixed5d0495473ee4c1d041b5a917f10446a22c047f47
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced45919fbfe1c487c17ea1d198534339a5e8abeae3Fixeda2db328b0839312c169eb42746ec46fc1ab53ed2