In the Linux kernel, the following vulnerability has been resolved:
interconnect: Don't access req_list while it's being manipulated
The icclock mutex was split into separate icclock and iccbwlock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to iccnode::reqlist.
The iccsetbw() function will eventually iterate over reqlist while only holding iccbwlock, but reqlist can be modified while only holding icclock. This causes races between iccsetbw(), oficcget(), and iccput().
Example A:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); iccput(pathb) mutexlock(&icclock); aggregaterequests() hlistforeachentry(r, ... hlist_del(... <r = invalid pointer>
Example B:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); pathb = oficcget() oficcgetbyindex() mutexlock(&icclock); pathfind() pathinit() aggregaterequests() hlistforeachentry(r, ... hlistadd_head(... <r = invalid pointer>
Fix this by ensuring iccbwlock is always held before manipulating iccnode::reqlist. The additional places iccbwlock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.
[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27005.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27005.json"
[
{
"signature_type": "Line",
"target": {
"file": "drivers/interconnect/core.c"
},
"deprecated": false,
"id": "CVE-2024-27005-11e5a82c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236938039760411660794035572650465518631",
"259404703530361354133782066897755546984",
"310332355837238762569653871372055932170",
"149358194467291076503768868948349972216",
"179547628034014487545259615802223766847",
"69280356162551609451184253369463769655",
"335098832334979540305666275938278143764",
"236571226524458001195260216706739059253",
"323654088598814521921848768195789221540",
"119415979497494493830967989545452271085",
"225578889553073272272969383779565225867",
"62487419168102789038046692716056069083",
"312865345453967492118989194020026944515",
"38303676927935449794955983730688537826",
"157697521812664983074754423204901992478",
"120100839644420647630966363028637219391",
"320642605397965243788947571529307413690",
"174133661571848420991687740493760921661",
"3192973321740200191002619398904512897",
"45783672358317305144147013342729123909",
"280053051360915202531769949057249893946",
"109411621916995346448451096379770231473",
"179099642957047525965182412236192652826",
"198056078387757036681738869141495400696"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec82b3cad1abef2a929262b8c1528f4e0c192d"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_set_bw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec82b3cad1abef2a929262b8c1528f4e0c192d",
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "123005818127460584558285892781451373571",
"length": 958.0
},
"id": "CVE-2024-27005-31911632"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_node_add"
},
"deprecated": false,
"id": "CVE-2024-27005-4729bc2c",
"signature_version": "v1",
"digest": {
"function_hash": "214510878026302461368776398813023731458",
"length": 820.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe549d8e976300d0dd75bd904eb216bed8b145e0"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/interconnect/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe549d8e976300d0dd75bd904eb216bed8b145e0",
"id": "CVE-2024-27005-595c2336",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"236938039760411660794035572650465518631",
"259404703530361354133782066897755546984",
"310332355837238762569653871372055932170",
"149358194467291076503768868948349972216",
"179547628034014487545259615802223766847",
"69280356162551609451184253369463769655",
"335098832334979540305666275938278143764",
"236571226524458001195260216706739059253",
"323654088598814521921848768195789221540",
"119415979497494493830967989545452271085",
"225578889553073272272969383779565225867",
"62487419168102789038046692716056069083",
"312865345453967492118989194020026944515",
"38303676927935449794955983730688537826",
"157697521812664983074754423204901992478",
"120100839644420647630966363028637219391",
"320642605397965243788947571529307413690",
"174133661571848420991687740493760921661",
"3192973321740200191002619398904512897",
"45783672358317305144147013342729123909",
"280053051360915202531769949057249893946",
"109411621916995346448451096379770231473",
"179099642957047525965182412236192652826",
"198056078387757036681738869141495400696"
]
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_sync_state"
},
"deprecated": false,
"id": "CVE-2024-27005-7743733e",
"signature_version": "v1",
"digest": {
"function_hash": "261220659485892666850978906257853076659",
"length": 602.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe549d8e976300d0dd75bd904eb216bed8b145e0"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_sync_state"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec82b3cad1abef2a929262b8c1528f4e0c192d",
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "261220659485892666850978906257853076659",
"length": 602.0
},
"id": "CVE-2024-27005-89ac525c"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_node_add"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec82b3cad1abef2a929262b8c1528f4e0c192d",
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "214510878026302461368776398813023731458",
"length": 820.0
},
"id": "CVE-2024-27005-98b7dea6"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/interconnect/core.c",
"function": "icc_set_bw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe549d8e976300d0dd75bd904eb216bed8b145e0",
"id": "CVE-2024-27005-ec109ba5",
"deprecated": false,
"digest": {
"function_hash": "123005818127460584558285892781451373571",
"length": 958.0
},
"signature_version": "v1"
}
]