In the Linux kernel, the following vulnerability has been resolved:
ext4: fix idatasem unlock order in ext4indmigrate()
Fuzzing reports a possible deadlock in jbd2logwait_commit.
This issue is triggered when an EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with OSYNC. This can lead to the jbd2journalstop() function calling jbd2mightwaitforcommit(), potentially causing a deadlock if the EXT4IOC_MIGRATE call races with a write(2) system call.
This problem only arises when CONFIGPROVELOCKING is enabled. In this case, the jbd2mightwaitforcommit macro locks jbd2handle in the jbd2journalstop function while idatasem is locked. This triggers lockdep because the jbd2journalstart function might also lock the same jbd2handle simultaneously.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Rule: add
[
{
"digest": {
"function_hash": "64699543426298460910125416143385017927",
"length": 1626.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-08012660",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05572da0c0eb89614ed01cc17d3c882bdbd1ff",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"67206116044173049796410033425817716227",
"6314769982930652137382093062435489963"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-19de573d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fedf51ab8cf7b69bff08f37fe0989fec7f5d870",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"134272099336236102163601529217360265230",
"291658275221836846814579451947920622095"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-28304a79",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6252cb6bde7fc76cb8dcb49d1def7c326b190820",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"function_hash": "116782022921241873702829312219192453505",
"length": 1622.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-32d48b8b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43776b907659affef1de888525847d64b244194",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"function_hash": "46578710653520942199288632491209142533",
"length": 1565.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-5201a6d6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4192adefc9c570698821c5eb9873320eac2fcbf1",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"function_hash": "116782022921241873702829312219192453505",
"length": 1622.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-648c7277",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6252cb6bde7fc76cb8dcb49d1def7c326b190820",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"function_hash": "64699543426298460910125416143385017927",
"length": 1626.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-7c98b27f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53b1999cfd2c7addf2e581a32865fe8835467b44",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"function_hash": "116782022921241873702829312219192453505",
"length": 1622.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-84332c55",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d58a00e981d3118b91d503da263e640b7cde6729",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"134272099336236102163601529217360265230",
"291658275221836846814579451947920622095"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-90d66fd2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc749e61c011c255d81b192a822db650c68b313f",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"function_hash": "46578710653520942199288632491209142533",
"length": 1565.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-9ba62bee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c46d6060d3e38de22196c1fe7706c5a3c696285",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"134272099336236102163601529217360265230",
"291658275221836846814579451947920622095"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-a6c905f2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d58a00e981d3118b91d503da263e640b7cde6729",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"function_hash": "116782022921241873702829312219192453505",
"length": 1622.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-b6dbb971",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc749e61c011c255d81b192a822db650c68b313f",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"85348535233134740620387309127661117758",
"12052025753705577404023903441848977541",
"50734248245721939994474578546614530747",
"67206116044173049796410033425817716227",
"6314769982930652137382093062435489963"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-bc748edf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4192adefc9c570698821c5eb9873320eac2fcbf1",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"67206116044173049796410033425817716227",
"6314769982930652137382093062435489963"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-bf13dee6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53b1999cfd2c7addf2e581a32865fe8835467b44",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"function_hash": "64699543426298460910125416143385017927",
"length": 1626.0
},
"target": {
"file": "fs/ext4/migrate.c",
"function": "ext4_ind_migrate"
},
"id": "CVE-2024-50006-c583e6ef",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fedf51ab8cf7b69bff08f37fe0989fec7f5d870",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"85348535233134740620387309127661117758",
"12052025753705577404023903441848977541",
"50734248245721939994474578546614530747",
"67206116044173049796410033425817716227",
"6314769982930652137382093062435489963"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-c76be5ed",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c46d6060d3e38de22196c1fe7706c5a3c696285",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"67206116044173049796410033425817716227",
"6314769982930652137382093062435489963"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-cdf88732",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05572da0c0eb89614ed01cc17d3c882bdbd1ff",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"328402502234202647730569079622060402746",
"113644571203826344329485383712820559456",
"50734248245721939994474578546614530747",
"134272099336236102163601529217360265230",
"291658275221836846814579451947920622095"
]
},
"target": {
"file": "fs/ext4/migrate.c"
},
"id": "CVE-2024-50006-eea359e3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43776b907659affef1de888525847d64b244194",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
}
]