CVE-2024-47679

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vfs: fix race between evice_inodes() and find_inode()&iput()

Hi, all

Recently I noticed a bug[1] in btrfs, after digged it into

and I believe it'a race in vfs.

Let's assume there's a inode (ie ino 261) with i_count 1 is

called by iput(), and there's a concurrent thread calling

generic_shutdown_super().

cpu0: cpu1:

iput() // i_count is 1

->spin_lock(inode)

->dec i_count to 0

->iput_final() generic_shutdown_super()

->__inode_add_lru() ->evict_inodes()

// cause some reason[2] ->if (atomic_read(inode->i_count)) continue;

// return before // inode 261 passed the above check

// list_lru_add_obj() // and then schedule out

->spin_unlock()

// note here: the inode 261

// was still at sb list and hash list,

// and I_FREEING|I_WILL_FREE was not been set

btrfs_iget()

// after some function call

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References