CVE-2024-26775

aoe: avoid potential deadlock at set_capacity

published April 3, 2024

CVSS
—
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

aoe: avoid potential deadlock at set_capacity

Move set_capacity() outside of the section procected by (&d->lock).

To avoid possible interrupt unsafe locking scenario:

CPU0 CPU1

---- ----

[1] lock(&bdev->bd_size_lock);

local_irq_disable();

[2] lock(&d->lock);

[3] lock(&bdev->bd_size_lock);

<Interrupt>

[4] lock(&d->lock);

*** DEADLOCK ***

Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity().

[2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()

is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call.

In this situation an attempt to acquire [4]lock(&d->lock) from

aoecmd_cfg_rsp() will lead to deadlock.

So the simplest solution is breaking lock dependency

[2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity()

outside.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Published
2024-04-03T17:01Z
EPSS history
Timeline
  • 03 APR 17:01Z
    aoe: avoid potential deadlock at set_capacity
    cvelistv5