CVE-2024-36478

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> null_blk: fix null-ptr-dereference while configuring &amp;#39;power&amp;#39; and &amp;#39;submit_queues&amp;#39;<br /> <br /> Writing &amp;#39;power&amp;#39; and &amp;#39;submit_queues&amp;#39; concurrently will trigger kernel<br /> panic:<br /> <br /> Test script:<br /> <br /> modprobe null_blk nr_devices=0<br /> mkdir -p /sys/kernel/config/nullb/nullb0<br /> while true; do echo 1 &gt; submit_queues; echo 4 &gt; submit_queues; done &amp;<br /> while true; do echo 1 &gt; power; echo 0 &gt; power; done<br /> <br /> Test result:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000148<br /> Oops: 0000 [#1] PREEMPT SMP<br /> RIP: 0010:__lock_acquire+0x41d/0x28f0<br /> Call Trace:<br /> <br /> lock_acquire+0x121/0x450<br /> down_write+0x5f/0x1d0<br /> simple_recursive_removal+0x12f/0x5c0<br /> blk_mq_debugfs_unregister_hctxs+0x7c/0x100<br /> blk_mq_update_nr_hw_queues+0x4a3/0x720<br /> nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]<br /> nullb_device_submit_queues_store+0x79/0xf0 [null_blk]<br /> configfs_write_iter+0x119/0x1e0<br /> vfs_write+0x326/0x730<br /> ksys_write+0x74/0x150<br /> <br /> This is because del_gendisk() can concurrent with<br /> blk_mq_update_nr_hw_queues():<br /> <br /> nullb_device_power_store nullb_apply_submit_queues<br /> null_del_dev<br /> del_gendisk<br /> nullb_update_nr_hw_queues<br /> if (!dev-&gt;nullb)<br /> // still set while gendisk is deleted<br /> return 0<br /> blk_mq_update_nr_hw_queues<br /> dev-&gt;nullb = NULL<br /> <br /> Fix this problem by resuing the global mutex to protect<br /> nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs.