CVE-2024-36966

erofs: reliably distinguish block based and fscache mode

published June 8, 2024

CVSS
—
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

erofs: reliably distinguish block based and fscache mode

When erofs_kill_sb() is called in block dev based mode, s_bdev may not

have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled,

it will be mistaken for fscache mode, and then attempt to free an anon_dev

that has never been allocated, triggering the following warning:

============================================

ida_free called for id=0 which is not allocated.

WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140

Modules linked in:

CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630

RIP: 0010:ida_free+0x134/0x140

Call Trace:

<TASK>

erofs_kill_sb+0x81/0x90

deactivate_locked_super+0x35/0x80

get_tree_bdev+0x136/0x1e0

vfs_get_tree+0x2c/0xf0

do_new_mount+0x190/0x2f0

[...]

============================================

Now when erofs_kill_sb() is called, erofs_sb_info must have been

initialised, so use sbi->fsid to distinguish between the two modes.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Published
2024-06-08T12:52Z
EPSS history
Timeline
  • 08 JUN 12:52Z
    erofs: reliably distinguish block based and fscache mode
    cvelistv5