CVE-2024-26962: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
First published: Wed May 01 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape For raid456, if reshape is still in progress, then IO across reshape position will wait for reshape to make progress. However, for dm-raid, in following cases reshape will never make progress hence IO will hang: 1) the array is read-only; 2) MD_RECOVERY_WAIT is set; 3) MD_RECOVERY_FROZEN is set; After commit c467e97f079f ("md/raid6: use valid sector values to determine if an I/O should wait on the reshape") fix the problem that IO across reshape position doesn't wait for reshape, the dm-raid test shell/lvconvert-raid-reshape.sh start to hang: [root@fedora ~]# cat /proc/979/stack [<0>] wait_woken+0x7d/0x90 [<0>] raid5_make_request+0x929/0x1d70 [raid456] [<0>] md_handle_request+0xc2/0x3b0 [md_mod] [<0>] raid_map+0x2c/0x50 [dm_raid] [<0>] __map_bio+0x251/0x380 [dm_mod] [<0>] dm_submit_bio+0x1f0/0x760 [dm_mod] [<0>] __submit_bio+0xc2/0x1c0 [<0>] submit_bio_noacct_nocheck+0x17f/0x450 [<0>] submit_bio_noacct+0x2bc/0x780 [<0>] submit_bio+0x70/0xc0 [<0>] mpage_readahead+0x169/0x1f0 [<0>] blkdev_readahead+0x18/0x30 [<0>] read_pages+0x7c/0x3b0 [<0>] page_cache_ra_unbounded+0x1ab/0x280 [<0>] force_page_cache_ra+0x9e/0x130 [<0>] page_cache_sync_ra+0x3b/0x110 [<0>] filemap_get_pages+0x143/0xa30 [<0>] filemap_read+0xdc/0x4b0 [<0>] blkdev_read_iter+0x75/0x200 [<0>] vfs_read+0x272/0x460 [<0>] ksys_read+0x7a/0x170 [<0>] __x64_sys_read+0x1c/0x30 [<0>] do_syscall_64+0xc6/0x230 [<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 This is because reshape can't make progress. For md/raid, the problem doesn't exist because register new sync_thread doesn't rely on the IO to be done any more: 1) If array is read-only, it can switch to read-write by ioctl/sysfs; 2) md/raid never set MD_RECOVERY_WAIT; 3) If MD_RECOVERY_FROZEN is set, mddev_suspend() doesn't hold 'reconfig_mutex', hence it can be cleared and reshape can continue by sysfs api 'sync_action'. However, I'm not sure yet how to avoid the problem in dm-raid yet. This patch on the one hand make sure raid_message() can't change sync_thread() through raid_message() after presuspend(), on the other hand detect the above 3 cases before wait for IO do be done in dm_suspend(), and let dm-raid requeue those IO.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <6.7.12 | 6.7.12 |
| redhat/kernel | <6.8.3 | 6.8.3 |
| redhat/kernel | <6.9 | 6.9 |
| Linux Kernel | <6.7.12 | |
| Linux Kernel | >=6.8<6.8.3 | |
| debian/linux | <=5.10.223-1<=5.10.234-1<=6.1.129-1<=6.1.135-1 | 6.12.25-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677
- https://git.kernel.org/stable/c/5943a34bf6bab5801e08a55f63e1b8d5bc90dae1
- https://git.kernel.org/stable/c/a8d249d770cb357d16a2097b548d2e4c1c137304
- https://launchpad.net/bugs/cve/CVE-2024-26962
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26962
- https://nvd.nist.gov/vuln/detail/CVE-2024-26962
- https://security-tracker.debian.org/tracker/CVE-2024-26962
- https://ubuntu.com/security/CVE-2024-26962
- https://git.kernel.org/linus/41425f96d7aa59bc865f60f5dda3d7697b555677
- https://access.redhat.com/security/cve/CVE-2024-26962
- https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26962-cbb0@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2278175
- https://access.redhat.com/errata/RHSA-2024:9315
- https://bugzilla.redhat.com/show_bug.cgi?id=2278174
Frequently Asked Questions
What is the severity of CVE-2024-26962?
CVE-2024-26962 has been classified with a moderate severity level due to its potential impact on system performance during concurrent I/O operations.
How do I fix CVE-2024-26962?
To resolve CVE-2024-26962, update the Linux kernel to version 6.7.12, 6.8.3, 6.9, or any version 6.12.10-1, 6.12.11-1, or subsequent.
Which Linux versions are affected by CVE-2024-26962?
CVE-2024-26962 affects Linux kernel versions prior to 6.7.12, versions between 6.8 and 6.8.3, as well as versions up to 6.10 from Debian kernel packages.
What is the nature of the deadlock in CVE-2024-26962?
The deadlock in CVE-2024-26962 occurs in the dm-raid456 subsystem when I/O operations are waiting for a reshape operation to complete.
Is there a workaround for CVE-2024-26962 if immediate patching is not possible?
Currently, there are no known workarounds for CVE-2024-26962 aside from timely updating the kernel to an unaffected version.
- agent/title
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-26962
- agent/software-canonical-lookup
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.8
- package-manager/debian