CVE-2023-53329

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> workqueue: fix data race with the pwq-&gt;stats[] increment<br /> <br /> KCSAN has discovered a data race in kernel/workqueue.c:2598:<br /> <br /> [ 1863.554079] ==================================================================<br /> [ 1863.554118] BUG: KCSAN: data-race in process_one_work / process_one_work<br /> <br /> [ 1863.554142] write to 0xffff963d99d79998 of 8 bytes by task 5394 on cpu 27:<br /> [ 1863.554154] process_one_work (kernel/workqueue.c:2598)<br /> [ 1863.554166] worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2752)<br /> [ 1863.554177] kthread (kernel/kthread.c:389)<br /> [ 1863.554186] ret_from_fork (arch/x86/kernel/process.c:145)<br /> [ 1863.554197] ret_from_fork_asm (arch/x86/entry/entry_64.S:312)<br /> <br /> [ 1863.554213] read to 0xffff963d99d79998 of 8 bytes by task 5450 on cpu 12:<br /> [ 1863.554224] process_one_work (kernel/workqueue.c:2598)<br /> [ 1863.554235] worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2752)<br /> [ 1863.554247] kthread (kernel/kthread.c:389)<br /> [ 1863.554255] ret_from_fork (arch/x86/kernel/process.c:145)<br /> [ 1863.554266] ret_from_fork_asm (arch/x86/entry/entry_64.S:312)<br /> <br /> [ 1863.554280] value changed: 0x0000000000001766 -&gt; 0x000000000000176a<br /> <br /> [ 1863.554295] Reported by Kernel Concurrency Sanitizer on:<br /> [ 1863.554303] CPU: 12 PID: 5450 Comm: kworker/u64:1 Tainted: G L 6.5.0-rc6+ #44<br /> [ 1863.554314] Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023<br /> [ 1863.554322] Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]<br /> [ 1863.554941] ==================================================================<br /> <br /> lockdep_invariant_state(true);<br /> → pwq-&gt;stats[PWQ_STAT_STARTED]++;<br /> trace_workqueue_execute_start(work);<br /> worker-&gt;current_func(work);<br /> <br /> Moving pwq-&gt;stats[PWQ_STAT_STARTED]++; before the line<br /> <br /> raw_spin_unlock_irq(&amp;pool-&gt;lock);<br /> <br /> resolves the data race without performance penalty.<br /> <br /> KCSAN detected at least one additional data race:<br /> <br /> [ 157.834751] ==================================================================<br /> [ 157.834770] BUG: KCSAN: data-race in process_one_work / process_one_work<br /> <br /> [ 157.834793] write to 0xffff9934453f77a0 of 8 bytes by task 468 on cpu 29:<br /> [ 157.834804] process_one_work (/home/marvin/linux/kernel/linux_torvalds/kernel/workqueue.c:2606)<br /> [ 157.834815] worker_thread (/home/marvin/linux/kernel/linux_torvalds/./include/linux/list.h:292 /home/marvin/linux/kernel/linux_torvalds/kernel/workqueue.c:2752)<br /> [ 157.834826] kthread (/home/marvin/linux/kernel/linux_torvalds/kernel/kthread.c:389)<br /> [ 157.834834] ret_from_fork (/home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/process.c:145)<br /> [ 157.834845] ret_from_fork_asm (/home/marvin/linux/kernel/linux_torvalds/arch/x86/entry/entry_64.S:312)<br /> <br /> [ 157.834859] read to 0xffff9934453f77a0 of 8 bytes by task 214 on cpu 7:<br /> [ 157.834868] process_one_work (/home/marvin/linux/kernel/linux_torvalds/kernel/workqueue.c:2606)<br /> [ 157.834879] worker_thread (/home/marvin/linux/kernel/linux_torvalds/./include/linux/list.h:292 /home/marvin/linux/kernel/linux_torvalds/kernel/workqueue.c:2752)<br /> [ 157.834890] kthread (/home/marvin/linux/kernel/linux_torvalds/kernel/kthread.c:389)<br /> [ 157.834897] ret_from_fork (/home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/process.c:145)<br /> [ 157.834907] ret_from_fork_asm (/home/marvin/linux/kernel/linux_torvalds/arch/x86/entry/entry_64.S:312)<br /> <br /> [ 157.834920] value changed: 0x000000000000052a -&gt; 0x0000000000000532<br /> <br /> [ 157.834933] Reported by Kernel Concurrency Sanitizer on:<br /> [ 157.834941] CPU: 7 PID: 214 Comm: kworker/u64:2 Tainted: G L 6.5.0-rc7-kcsan-00169-g81eaf55a60fc #4<br /> [ 157.834951] Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023<br /> [ 157.834958] Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]<br /> [ 157.835567] ==================================================================<br /> <br /> in code:<br /> <br /> trace_workqueue_execute_end(work, worker-&gt;current_func);<br /> → pwq-&gt;stats[PWQ_STAT_COM<br /> ---truncated---