Description
In the Linux kernel, the following vulnerability has been resolved:
net/9p: use a dedicated spinlock for trans_fd
Shamelessly copying the explanation from Tetsuo Handa's suggested
patch[1] (slightly reworded):
syzbot is reporting inconsistent lock state in p9_req_put()[2],
for p9_tag_remove() from p9_req_put() from IRQ context is using
spin_lock_irqsave() on "struct p9_client"->lock but trans_fd
(not from IRQ context) is using spin_lock().
Since the locks actually protect different things in client.c and in
trans_fd.c, just replace trans_fd.c's lock by a new one specific to the
transport (client.c's protect the idr for fid/tag allocations,
while trans_fd.c's protects its own req list and request status field
that acts as the transport's state machine)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.28 | 5.15.80 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.10-1 | — |
| Debian 13 | linux | 6.0.10-1 | — |
| Debian 12 | linux | 6.0.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1014.16 | — |
| Ubuntu 24.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-67.74 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1031.35 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1034.41 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1034.41.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1030.37 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1028.33 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1016.21 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1026.29 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1026.31 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1029.34 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1023.23 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1030.36 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1025.27 | — |
| Ubuntu 22.04 LTS | linux-riscv +31 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1031.35~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1034.41~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1030.37~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-67.74~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1026.31~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1014.14~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1030.36~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1030.34~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1022.27 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1033.36 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +10 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |