CVE-2023-53860

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dm: don't attempt to queue IO under RCU protection

dm looks up the table for IO based on the request type, with an

assumption that if the request is marked REQ_NOWAIT, it's fine to

attempt to submit that IO while under RCU read lock protection. This

is not OK, as REQ_NOWAIT just means that we should not be sleeping

waiting on other IO, it does not mean that we can't potentially

schedule.

A simple test case demonstrates this quite nicely:

int main(int argc, char *argv[])

{

struct iovec iov;

int fd;

fd = open("/dev/dm-0", O_RDONLY | O_DIRECT);

posix_memalign(&iov.iov_base, 4096, 4096);

iov.iov_len = 4096;

preadv2(fd, &iov, 1, 0, RWF_NOWAIT);

return 0;

}

which will instantly spew:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306

in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5580, name: dm-nowait

preempt_count: 0, expe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References