dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.151, 6.12.103, 6.18.44, 7.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the last reference, idxd_file_dev_release() runs synchronously and tries to take wq->wq_lock again, deadlocking. Those paths also fall through into the later ctx cleanup labels even though idxd_file_dev_release() owns that cleanup and frees ctx. This can make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context. Move idxd_wq_get() before file-device setup can fail, since the release callback always calls idxd_wq_put(). Then unlock wq->wq_lock before put_device(fdev) and return directly from the file-device setup failure path, leaving ctx cleanup to the release callback.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec · fixed in 778ccbded2c8749c5be7f0dfa04fc9977a36fb7e; From e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec · fixed in 8d5d28285728be47c82fdf1c48be4268293c90e7; From e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec · fixed in 0679c0c189d2548f00e1bac95be28e2df5c6c7f7; From e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec · fixed in 6e26a41c4c1a706edaaa7c7dffc6b3b945707a55; From e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec · fixed in ee1d7274102285d78a53161fc705a8d8cd40b066
- Linux Linux
6.4
- KernelLinux
From 6.4.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8