High · published May 2, 2025
In the Linux kernel, the following vulnerability has been resolved:
loop: Fix use-after-free issues
do_req_filebacked() calls blk_mq_complete_request() synchronously or
asynchronously when using asynchronous I/O unless memory allocation fails.
Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor
'rq' after do_req_filebacked() finished unless we are sure that the request
has not yet been completed. This patch fixes the following kernel crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054
Call trace:
css_put.42938+0x1c/0x1ac
loop_process_work+0xc8c/0xfd4
loop_rootcg_workfn+0x24/0x34
process_one_work+0x244/0x558
worker_thread+0x400/0x8fc
kthread+0x16c/0x1e0
ret_from_fork+0x10/0x20
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.4, < 5.15.104 | 5.15.104 |
| linux/linux_kernel | ≥ 5.16, < 6.1.21 | 6.1.21 |
| linux/linux_kernel | ≥ 6.2, < 6.2.8 | 6.2.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |