CVE-2024-41053
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-41053
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41053.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-41053
- Downstream
- Related
- Published
- 2024-07-29T14:32:08Z
- Modified
- 2025-10-17T08:32:23.215240Z
- Summary
- scsi: ufs: core: Fix ufshcd_abort_one racing issue
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix ufshcdabortone racing issue
When ufshcdabortone is racing with the completion ISR, the completed tag of the request's mqhctx pointer will be set to NULL by ISR. Return success when request is completed by ISR because ufshcdabort_one does not need to do anything.
The racing flow is:
Thread A ufshcderrhandler step 1 ... ufshcdabortone ufshcdtrytoaborttask ufshcdcmdinflight(true) step 3 ufshcdmcqreqtohwq blkmquniquetag rq->mqhctx->queue_num step 5
Thread B ufsmtkmcqintr(cq complete ISR) step 2 scsidone ... _blkmqfreerequest rq->mq_hctx = NULL; step 4
Below is KE back trace. ufshcdtrytoaborttask: cmd at tag 41 not pending in the device. ufshcdtrytoaborttask: cmd at tag=41 is cleared. Aborting tag 41 / CDB 0x28 succeeded Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194 pc : [0xffffffddd7a79bf8] blkmquniquetag+0x8/0x14 lr : [0xffffffddd6155b84] ufshcdmcqreqtohwq+0x1c/0x40 [ufsmediatekmodise] domemabort+0x58/0x118 el1abort+0x3c/0x5c el1h64synchandler+0x54/0x90 el1h64sync+0x68/0x6c blkmquniquetag+0x8/0x14 ufshcderrhandler+0xae4/0xfa8 [ufsmediatekmodise] processonework+0x208/0x4fc workerthread+0x228/0x438 kthread+0x104/0x1d4 retfrom_fork+0x10/0x20
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedff7699d3620763b0dfe2ff93df4528880bf903a8Fixedc3111b3cf3889bfa7b73ebff83d7397db9b7e5e0
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced93e6c0e19d5bb12b49534a411c85e21d333731faFixedb5a6ac887256762758bfe7f2918cb0233aa544f4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced93e6c0e19d5bb12b49534a411c85e21d333731faFixed74736103fb4123c71bf11fb7a6abe7c884c5269e
Affected versions
v6.*
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74736103fb4123c71bf11fb7a6abe7c884c5269e",
"digest": {
"line_hashes": [
"101594175125060328205248755916585427670",
"226047686910975952502007086720187589610",
"32400172596560537997790209662145477146",
"176761753757751080101937175683757261031"
],
"threshold": 0.9
},
"id": "CVE-2024-41053-00b13909",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ufshcd_abort_one",
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0",
"digest": {
"length": 764.0,
"function_hash": "165505955163359376887931389885673520902"
},
"id": "CVE-2024-41053-086d6f20",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5a6ac887256762758bfe7f2918cb0233aa544f4",
"digest": {
"line_hashes": [
"101594175125060328205248755916585427670",
"226047686910975952502007086720187589610",
"32400172596560537997790209662145477146",
"176761753757751080101937175683757261031"
],
"threshold": 0.9
},
"id": "CVE-2024-41053-6e078ff7",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ufshcd_abort_one",
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5a6ac887256762758bfe7f2918cb0233aa544f4",
"digest": {
"length": 764.0,
"function_hash": "165505955163359376887931389885673520902"
},
"id": "CVE-2024-41053-731a9d36",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ufshcd_abort_one",
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74736103fb4123c71bf11fb7a6abe7c884c5269e",
"digest": {
"length": 764.0,
"function_hash": "165505955163359376887931389885673520902"
},
"id": "CVE-2024-41053-d776426c",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/ufs/core/ufshcd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0",
"digest": {
"line_hashes": [
"101594175125060328205248755916585427670",
"226047686910975952502007086720187589610",
"32400172596560537997790209662145477146",
"176761753757751080101937175683757261031"
],
"threshold": 0.9
},
"id": "CVE-2024-41053-ee3ab60b",
"signature_version": "v1",
"deprecated": false
}
]