UBUNTU-CVE-2024-45003
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate( ---truncated---
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
38 explicit affected versions
52 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
61 explicit affected versions
14 explicit affected versions
47 explicit affected versions
68 explicit affected versions
57 explicit affected versions
47 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
54 explicit affected versions
7 explicit affected versions
53 explicit affected versions
9 explicit affected versions
95 explicit affected versions
13 explicit affected versions
85 explicit affected versions
11 explicit affected versions
35 explicit affected versions
14 explicit affected versions
18 explicit affected versions
18 explicit affected versions
15 explicit affected versions
118 explicit affected versions
64 explicit affected versions
14 explicit affected versions
97 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
18 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
52 explicit affected versions
16 explicit affected versions
7 explicit affected versions
12 explicit affected versions
111 explicit affected versions
45 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
85 explicit affected versions
12 explicit affected versions
100 explicit affected versions
108 explicit affected versions
12 explicit affected versions
9 explicit affected versions
96 explicit affected versions
14 explicit affected versions
9 explicit affected versions
1 explicit affected versions
10 explicit affected versions
37 explicit affected versions
13 explicit affected versions
7 explicit affected versions
10 explicit affected versions
33 explicit affected versions
1 explicit affected versions
35 explicit affected versions
26 explicit affected versions
13 explicit affected versions
9 explicit affected versions
1 explicit affected versions
29 explicit affected versions
88 explicit affected versions
13 explicit affected versions
58 explicit affected versions
8 explicit affected versions
9 explicit affected versions
1 explicit affected versions
83 explicit affected versions
56 explicit affected versions
100 explicit affected versions
18 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
1 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
98 explicit affected versions
138 explicit affected versions
45 explicit affected versions
39 explicit affected versions
132 explicit affected versions
55 explicit affected versions
154 explicit affected versions
10 explicit affected versions
26 explicit affected versions
16 explicit affected versions
34 explicit affected versions
1 explicit affected versions
7 explicit affected versions
17 explicit affected versions
13 explicit affected versions
16 explicit affected versions
139 explicit affected versions
58 explicit affected versions
16 explicit affected versions
58 explicit affected versions
17 explicit affected versions
46 explicit affected versions
116 explicit affected versions
3 explicit affected versions
93 explicit affected versions
1 explicit affected versions
2 explicit affected versions
65 explicit affected versions
51 explicit affected versions
92 explicit affected versions
14 explicit affected versions
12 explicit affected versions
44 explicit affected versions
27 explicit affected versions
30 explicit affected versions
1 explicit affected versions
1 explicit affected versions
98 explicit affected versions
10 explicit affected versions
8 explicit affected versions
19 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
13 explicit affected versions
13 explicit affected versions
87 explicit affected versions
13 explicit affected versions
52 explicit affected versions
7 explicit affected versions
140 explicit affected versions
94 explicit affected versions
50 explicit affected versions
10 explicit affected versions
14 explicit affected versions
12 explicit affected versions
87 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
44 explicit affected versions
37 explicit affected versions
17 explicit affected versions
14 explicit affected versions
38 explicit affected versions
167 explicit affected versions
47 explicit affected versions
9 explicit affected versions
47 explicit affected versions
11 explicit affected versions
8 explicit affected versions
7 explicit affected versions
55 explicit affected versions
7 explicit affected versions
28 explicit affected versions
59 explicit affected versions
121 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
53 explicit affected versions
13 explicit affected versions
43 explicit affected versions
53 explicit affected versions
10 explicit affected versions
8 explicit affected versions
12 explicit affected versions
14 explicit affected versions
88 explicit affected versions
4 explicit affected versions
77 explicit affected versions
11 explicit affected versions
1 explicit affected versions
69 explicit affected versions
10 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate( ---truncated---
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/2a0629834cd82f05d424bbc193374f9a43d1f87d
- https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8
- https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d
- https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72
- https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98
- https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f
- https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32
- https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88
- https://ubuntu.com/security/CVE-2024-45003
- https://ubuntu.com/security/notices/USN-7088-1
- https://ubuntu.com/security/notices/USN-7088-2
- https://ubuntu.com/security/notices/USN-7088-3
- https://ubuntu.com/security/notices/USN-7088-4
- https://ubuntu.com/security/notices/USN-7088-5
- https://ubuntu.com/security/notices/USN-7100-1
- https://ubuntu.com/security/notices/USN-7100-2
- https://ubuntu.com/security/notices/USN-7119-1
- https://ubuntu.com/security/notices/USN-7123-1
- https://ubuntu.com/security/notices/USN-7144-1
- https://ubuntu.com/security/notices/USN-7154-1
- https://ubuntu.com/security/notices/USN-7154-2
- https://ubuntu.com/security/notices/USN-7155-1
- https://ubuntu.com/security/notices/USN-7156-1
- https://ubuntu.com/security/notices/USN-7194-1
- https://ubuntu.com/security/notices/USN-7196-1
- https://www.cve.org/CVERecord?id=CVE-2024-45003