CVE-2024-26756

md: Don't register sync_thread for reshape directly

published April 3, 2024

CVSS
—
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

md: Don't register sync_thread for reshape directly

Currently, if reshape is interrupted, then reassemble the array will

register sync_thread directly from pers->run(), in this case

'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee

that md_do_sync() will be executed, hence stop_sync_thread() will hang

because 'MD_RECOVERY_RUNNING' can't be cleared.

Last patch make sure that md_do_sync() will set MD_RECOVERY_DONE,

however, following hang can still be triggered by dm-raid test

shell/lvconvert-raid-reshape.sh occasionally:

[root@fedora ~]# cat /proc/1982/stack

[<0>] stop_sync_thread+0x1ab/0x270 [md_mod]

[<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod]

[<0>] raid_presuspend+0x1e/0x70 [dm_raid]

[<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]

[<0>] __dm_destroy+0x2a5/0x310 [dm_mod]

[<0>] dm_destroy+0x16/0x30 [dm_mod]

[<0>] dev_remove+0x165/0x290 [dm_mod]

[<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod]

[<0>] dm_ctl_ioctl+0x11/0x20 [dm_mod]

[<0>] vfs_ioctl+0x21/0x60

[<0>] __x64_sys_ioctl+0xb9/0xe0

[<0>] do_syscall_64+0xc6/0x230

[<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

Meanwhile mddev->recovery is:

MD_RECOVERY_RUNNING |

MD_RECOVERY_INTR |

MD_RECOVERY_RESHAPE |

MD_RECOVERY_FROZEN

Fix this problem by remove the code to register sync_thread directly

from raid10 and raid5. And let md_check_recovery() to register

sync_thread.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.4th percentile
Published
2024-04-03T17:00Z
EPSS history
Timeline
  • 03 APR 17:00Z
    md: Don't register sync_thread for reshape directly
    cvelistv5