jbd2: check need_resched() when skipping busy checkpoint buffers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.16, 6.2, 6.5, 6.6.160, 6.12.109, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in dc7ece0b827fe3b748db685fb85cd2fc3710c3f9; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in f83c23286e54180cdc83a36463a60003534cc290; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in f9182a85991a0ad5cd2940df6db75f40ad90028c; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in 595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in f213e12ff5c9590b1034ae8da0e6d09665c772d0; From 5.15.129 · fixed in 5.16; From 6.1.50 · fixed in 6.2; From 6.4.13 · fixed in 6.5
- Linux Linux
6.5
- KernelLinux
From 6.5.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4