CVE-2024-53689

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-53689
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53689.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-53689
Related
Withdrawn
2025-02-13T18:49:45.828737Z
Published
2025-01-11T13:15:26Z
Modified
2025-01-16T17:49:52.596822Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

block: Fix potential deadlock while freezing queue and acquiring sysfs_lock

For storing a value to a queue attribute, the queueattrstore function first freezes the queue (->qusagecounter(io)) and then acquire ->sysfslock. This seems not correct as the usual ordering should be to acquire ->sysfslock before freezing the queue. This incorrect ordering causes the following lockdep splat which we are able to reproduce always simply by accessing /sys/kernel/debug file using ls command:

[ 57.597146] WARNING: possible circular locking dependency detected [ 57.597154] 6.12.0-10553-gb86545e02e8c #20 Tainted: G W [ 57.597162] ------------------------------------------------------ [ 57.597168] ls/4605 is trying to acquire lock: [ 57.597176] c00000003eb56710 (&mm->mmaplock){++++}-{4:4}, at: _mightfault+0x58/0xc0 [ 57.597200] but task is already holding lock: [ 57.597207] c0000018e27c6810 (&sb->stype->imutexkey#3){++++}-{4:4}, at: iterate_dir+0x94/0x1d4 [ 57.597226] which lock already depends on the new lock.

[ 57.597233] the existing dependency chain (in reverse order) is: [ 57.597241] -> #5 (&sb->stype->imutexkey#3){++++}-{4:4}: [ 57.597255] downwrite+0x6c/0x18c [ 57.597264] startcreating+0xb4/0x24c [ 57.597274] debugfscreatedir+0x2c/0x1e8 [ 57.597283] blkregisterqueue+0xec/0x294 [ 57.597292] adddiskfwnode+0x2e4/0x548 [ 57.597302] brdalloc+0x2c8/0x338 [ 57.597309] brdinit+0x100/0x178 [ 57.597317] dooneinitcall+0x88/0x3e4 [ 57.597326] kernelinitfreeable+0x3cc/0x6e0 [ 57.597334] kernelinit+0x34/0x1cc [ 57.597342] retfromkerneluserthread+0x14/0x1c [ 57.597350] -> #4 (&q->debugfsmutex){+.+.}-{4:4}: [ 57.597362] _mutexlock+0xfc/0x12a0 [ 57.597370] blkregisterqueue+0xd4/0x294 [ 57.597379] adddiskfwnode+0x2e4/0x548 [ 57.597388] brdalloc+0x2c8/0x338 [ 57.597395] brdinit+0x100/0x178 [ 57.597402] dooneinitcall+0x88/0x3e4 [ 57.597410] kernelinitfreeable+0x3cc/0x6e0 [ 57.597418] kernelinit+0x34/0x1cc [ 57.597426] retfromkerneluserthread+0x14/0x1c [ 57.597434] -> #3 (&q->sysfslock){+.+.}-{4:4}: [ 57.597446] _mutexlock+0xfc/0x12a0 [ 57.597454] queueattrstore+0x9c/0x110 [ 57.597462] sysfskfwrite+0x70/0xb0 [ 57.597471] kernfsfopwriteiter+0x1b0/0x2ac [ 57.597480] vfswrite+0x3dc/0x6e8 [ 57.597488] ksyswrite+0x84/0x140 [ 57.597495] systemcallexception+0x130/0x360 [ 57.597504] systemcallcommon+0x160/0x2c4 [ 57.597516] -> #2 (&q->qusagecounter(io)#21){++++}-{0:0}: [ 57.597530] _submitbio+0x5ec/0x828 [ 57.597538] submitbionoacctnocheck+0x1e4/0x4f0 [ 57.597547] iomapreadahead+0x2a0/0x448 [ 57.597556] xfsvmreadahead+0x28/0x3c [ 57.597564] readpages+0x88/0x41c [ 57.597571] pagecacheraunbounded+0x1ac/0x2d8 [ 57.597580] filemapgetpages+0x188/0x984 [ 57.597588] filemapread+0x13c/0x4bc [ 57.597596] xfsfilebufferedread+0x88/0x17c [ 57.597605] xfsfilereaditer+0xac/0x158 [ 57.597614] vfsread+0x2d4/0x3b4 [ 57.597622] ksysread+0x84/0x144 [ 57.597629] systemcallexception+0x130/0x360 [ 57.597637] systemcallcommon+0x160/0x2c4 [ 57.597647] -> #1 (mapping.invalidatelock#2){++++}-{4:4}: [ 57.597661] downread+0x6c/0x220 [ 57.597669] filemapfault+0x870/0x100c [ 57.597677] xfsfilemapfault+0xc4/0x18c [ 57.597684] _dofault+0x64/0x164 [ 57.597693] _handlemmfault+0x1274/0x1dac [ 57.597702] handlemm_fault+0x248/0x48 ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.8-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}