CVE-2024-41054: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix ufshcdclearcmd racing issue
When ufshcdclearcmd is racing with the completion ISR, the completed tag of the request's mqhctx pointer will be set to NULL by the ISR. And ufshcdclearcmd's call to ufshcdmcqreqtohwq will get NULL pointer KE. Return success when the request is completed by ISR because sq does not need cleanup.
The racing flow is:
Thread A ufshcderrhandler step 1 ufshcdtrytoaborttask ufshcdcmdinflight(true) step 3 ufshcdclearcmd ... ufshcdmcqreqtohwq blkmquniquetag rq->mqhctx->queuenum step 5
Thread B ufsmtkmcqintr(cq complete ISR) step 2 scsidone ... blkmqfreerequest rq->mqhctx = NULL; step 4
Below is KE back trace:
ufshcdtrytoaborttask: cmd pending in the device. tag = 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194 pc : [0xffffffd589679bf8] blkmquniquetag+0x8/0x14 lr : [0xffffffd5862f95b4] ufshcdmcqsqcleanup+0x6c/0x1cc [ufsmediatekmodise] Workqueue: ufsehwq0 ufshcderrhandler [ufsmediatekmodise] Call trace: dumpbacktrace+0xf8/0x148 showstack+0x18/0x24 dumpstacklvl+0x60/0x7c dumpstack+0x18/0x3c mrdumpcommondie+0x24c/0x398 [mrdump] ipanicdie+0x20/0x34 [mrdump] notifydie+0x80/0xd8 die+0x94/0x2b8 dokernelfault+0x264/0x298 dopagefault+0xa4/0x4b8 dotranslationfault+0x38/0x54 domemabort+0x58/0x118 el1abort+0x3c/0x5c el1h64synchandler+0x54/0x90 el1h64sync+0x68/0x6c blkmquniquetag+0x8/0x14 ufshcdclearcmd+0x34/0x118 [ufsmediatekmodise] ufshcdtrytoaborttask+0x2c8/0x5b4 [ufsmediatekmodise] ufshcderrhandler+0xa7c/0xfa8 [ufsmediatekmodise] processonework+0x208/0x4fc workerthread+0x228/0x438 kthread+0x104/0x1d4 retfromfork+0x10/0x20
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41054?
CVE-2024-41054 is classified as a medium severity vulnerability in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-41054?
CVE-2024-41054 affects Linux kernel versions between 6.5 and 6.6.41 and versions between 6.7 and 6.9.10.
How do I fix CVE-2024-41054?
To mitigate CVE-2024-41054, you should upgrade to the latest patched version of the Linux kernel as recommended by your distribution.
Is there a workaround for CVE-2024-41054?
There is no known specific workaround for CVE-2024-41054; updating the kernel is the advised remediation.
What component is primarily affected by CVE-2024-41054?
CVE-2024-41054 primarily affects the SCSI UFS subsystem related to command handling in the Linux kernel.