Medium · published May 19, 2024
In the Linux kernel, the following vulnerability has been resolved:
sysv: don't call sb_bread() with pointers_lock held
syzbot is reporting sleep in atomic context in SysV filesystem [1], for
sb_bread() is called with rw_spinlock held.
A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug
and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by
"Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.
Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the
former bug by moving pointers_lock lock to the callers, but instead
introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made
this problem easier to hit).
Al Viro suggested that why not to do like get_branch()/get_block()/
find_shared() in Minix filesystem does. And doing like that is almost a
revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch()
from with find_shared() is called without write_lock(&pointers_lock).
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.19.312 | 4.19.312 |
| linux/linux_kernel | ≥ 4.20, < 5.4.274 | 5.4.274 |
| linux/linux_kernel | ≥ 5.5, < 5.10.215 | 5.10.215 |
| linux/linux_kernel | ≥ 5.11, < 5.15.155 | 5.15.155 |
| linux/linux_kernel | ≥ 5.16, < 6.1.86 | 6.1.86 |
| linux/linux_kernel | ≥ 6.2, < 6.6.27 | 6.6.27 |
| linux/linux_kernel | ≥ 6.7, < 6.8.6 | 6.8.6 |
| debian/debian_linux | all versions | — |