CVE-2024-56780

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56780
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56780.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-56780
Downstream
Related
Published
2025-01-08T17:49:17.889Z
Modified
2025-11-28T02:34:10.130320Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
quota: flush quota_release_work upon quota writeback
Details

In the Linux kernel, the following vulnerability has been resolved:

quota: flush quotareleasework upon quota writeback

One of the paths quota writeback is called from is:

freezesuper() syncfilesystem() ext4syncfs() dquotwritebackdquots()

Since we currently don't always flush the quotareleasework queue in this path, we can end up with the following race:

  1. dquot are added to releasing_dquots list during regular operations.
  2. FS Freeze starts, however, this does not flush the quotareleasework queue.
  3. Freeze completes.
  4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state:

    ext4journalcheckstart+0x28/0x110 [ext4] (unreliable) _ext4journalstartsb+0x64/0x1c0 [ext4] ext4releasedquot+0x90/0x1d0 [ext4] quotarelease_workfn+0x43c/0x4d0

Which is the following line:

WARNON(sb->swriters.frozen == SBFREEZECOMPLETE);

Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores.

To avoid this, make sure to flush the workqueue during dquotwritebackdquots() so we dont have any pending workitems after freeze.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56780.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d40c192e119892799dd4ddf94f5cea6fa93775ef
Fixed
a5abba5e0e586e258ded3e798fe5f69c66fec198
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
86d89987f0998c98f57d641e308b40452a994045
Fixed
6f3821acd7c3143145999248087de5fb4b48cf26
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
89602de9a2d7080b7a4029d5c1bf8f78d295ff5f
Fixed
ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3027e200dd58d5b437f16634dbbd355b29ffe0a6
Fixed
3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dabc8b20756601b9e1cc85a81d47d3f98ed4d13a
Fixed
bcacb52a985f1b6d280f698a470b873dfe52728a
Fixed
8ea87e34792258825d290f4dc5216276e91cb224
Fixed
ac6f420291b3fee1113f21d612fa88b628afab5b
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f3e9a2bbdeb8987508dd6bb2b701dea911d4daec
Last affected
903fc5d8cb48b0d2de7095ef40e39fd32bb27bd0
Last affected
31bed65eecbc5ce57592cfe31947eaa64e3d678e

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.4.287
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.231
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.174
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.120
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.64
Type
ECOSYSTEM
Events
Introduced
6.6.0
Fixed
6.12.4