CVE-2024-27031: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt

Published May 1, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix nfsnetfsissueread() xarray locking for writeback interrupt

The loop inside nfsnetfsissueread() currently does not disable interrupts while iterating through pages in the xarray to submit for NFS read. This is not safe though since after taking xalock, another page in the mapping could be processed for writeback inside an interrupt, and deadlock can occur. The fix is simple and clean if we use xaforeachrange(), which handles the iteration with RCU while reducing code complexity.

The problem is easily reproduced with the following test: mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1 echo 3 > /proc/sys/vm/dropcaches dd if=/mnt/nfs/file1.bin of=/dev/null umount /mnt/nfs

On the console with a lockdep-enabled kernel a message similar to the following will be seen:

================================ WARNING: inconsistent lock state 6.7.0-lockdbg+ #10 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. test5/1708 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888127baa598 (&xa->xalock#4){+.?.}-{3:3}, at: nfsnetfsissueread+0x1b2/0x4b0 [nfs] {IN-SOFTIRQ-W} state was registered at: lockacquire+0x144/0x380 rawspinlockirqsave+0x4e/0xa0 folioendwriteback+0x17e/0x5c0 folioendwriteback+0x93/0x1b0 iomapfinishioend+0xeb/0x6a0 blkupdaterequest+0x204/0x7f0 blkmqendrequest+0x30/0x1c0 blkcompletereqs+0x7e/0xa0 dosoftirq+0x113/0x544 irqexitrcu+0xfe/0x120 irqexitrcu+0xe/0x20 sysveccallfunctionsingle+0x6f/0x90 asmsysveccallfunctionsingle+0x1a/0x20 pvnativesafehalt+0xf/0x20 defaultidle+0x9/0x20 defaultidlecall+0x67/0xa0 doidle+0x2b5/0x300 cpustartupentry+0x34/0x40 startsecondary+0x19d/0x1c0 secondarystartup64noverify+0x18f/0x19b irq event stamp: 176891 hardirqs last enabled at (176891): [<ffffffffa67a0be4>] rawspinunlockirqrestore+0x44/0x60 hardirqs last disabled at (176890): [<ffffffffa67a0899>] rawspinlockirqsave+0x79/0xa0 softirqs last enabled at (176646): [<ffffffffa515d91e>] irqexitrcu+0xfe/0x120 softirqs last disabled at (176633): [<ffffffffa515d91e>] irqexitrcu+0xfe/0x120

other info that might help us debug this: Possible unsafe locking scenario:

CPU0 ---- lock(&xa->xalock#4); <Interrupt> lock(&xa->xalock#4);

DEADLOCK

2 locks held by test5/1708: #0: ffff888127baa498 (&sb->stype->imutexkey#22){++++}-{4:4}, at: nfsstartioread+0x28/0x90 [nfs] #1: ffff888127baa650 (mapping.invalidatelock#3){.+.+}-{4:4}, at: pagecacheraunbounded+0xa4/0x280

stack backtrace: CPU: 6 PID: 1708 Comm: test5 Kdump: loaded Not tainted 6.7.0-lockdbg+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Call Trace: dumpstacklvl+0x5b/0x90 marklock+0xb3f/0xd20 lockacquire+0x77b/0x3360 rawspinlock+0x34/0x80 nfsnetfsissueread+0x1b2/0x4b0 [nfs] netfsbeginread+0x77f/0x980 [netfs] nfsnetfsreadahead+0x45/0x60 [nfs] nfsreadahead+0x323/0x5a0 [nfs] readpages+0xf3/0x5c0 pagecacheraunbounded+0x1c8/0x280 filemapgetpages+0x38c/0xae0 filemapread+0x206/0x5e0 nfsfileread+0xb7/0x140 [nfs] vfsread+0x2a9/0x460 ksysread+0xb7/0x140

Affected Software

4 affected componentsFixes available
Linux Linux kernel>=6.4<6.6.23
Linux Linux kernel>=6.7<6.7.11
Linux Linux kernel>=6.8<6.8.2
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1

Event History

May 1, 2024
CVE Published
via MITRE·12:53 PM
Data Sourced
via MITRE·12:53 PM
Description
Jun 8, 2024
Data Sourced
via Launchpad·01:11 AM
Description
Jan 2, 2025
Data Sourced
via Ubuntu·06:09 AM
RemedyDescriptionSeverityAffected Software
Mar 27, 2025
Data Sourced
via Debian·02:17 PM
DescriptionAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-27031?

CVE-2024-27031 is regarded as a medium-severity vulnerability in the Linux kernel.

2

How do I fix CVE-2024-27031?

To fix CVE-2024-27031, update your Linux kernel to a version that incorporates the security patch addressing this issue.

3

Which versions of the Linux kernel are affected by CVE-2024-27031?

CVE-2024-27031 affects Linux kernel versions from 6.4 to 6.6.23, as well as 6.7 from 6.7.0 to 6.7.11, and 6.8 from 6.8.0 to 6.8.2.

4

What does CVE-2024-27031 involve in terms of technical detail?

CVE-2024-27031 involves an issue in the nfs_netfs_issue_read() function where interrupts are not disabled during iteration over pages submitted for NFS read.

5

Is there a known exploit for CVE-2024-27031?

As of now, there are no publicly reported exploits specifically targeting CVE-2024-27031.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203