CVE-2023-53210

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is

empty, and then submit 'flush_bio', however, r5l_log_flush_endio()

is clearing the list first and then clear the bio, which will cause

null-ptr-deref:

T1: submit flush io

raid5d

handle_active_stripes

r5l_flush_stripe_to_raid

// list is empty

// add 'io_end_ios' to the list

bio_init

submit_bio

// io1

T2: io1 is done

r5l_log_flush_endio

list_splice_tail_init

// clear the list

T3: submit new flush io

...

r5l_flush_stripe_to_raid

// list is empty

// add 'io_end_ios' to the list

bio_init

bio_uninit

// clear bio->bi_blkg

submit_bio

// null-ptr-deref

Fix this problem by clearing bio before clearing the list in

r5l_log_flush_endio().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References