{"id":"DEBIAN-CVE-2024-45003","details":"In the Linux kernel, the following vulnerability has been resolved:  vfs: Don't evict inode under the inode lru traversing context  The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen.  Case 1: In function ext4_evict_inode(), the ea inode lookup could happen         if ea_inode feature is enabled, the lookup process will be stuck \tunder the evicting context like this:   1. File A has inode i_reg and an ea inode i_ea  2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea  3. Then, following three processes running like this:      PA                              PB  echo 2 \u003e /proc/sys/vm/drop_caches   shrink_slab    prune_dcache_sb    // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg    prune_icache_sb     list_lru_walk_one      inode_lru_isolate       i_ea-\u003ei_state |= I_FREEING // set inode state      inode_lru_isolate       __iget(i_reg)       spin_unlock(&i_reg-\u003ei_lock)       spin_unlock(lru_lock)                                      rm file A                                       i_reg-\u003enlink = 0       iput(i_reg) // i_reg-\u003enlink is 0, do evict        ext4_evict_inode         ext4_xattr_delete_inode          ext4_xattr_inode_dec_ref_all           ext4_xattr_inode_iget            ext4_iget(i_ea-\u003ei_ino)             iget_locked              find_inode_fast               __wait_on_freeing_inode(i_ea) ----→ AA deadlock     dispose_list // cannot be executed by prune_icache_sb      wake_up_bit(&i_ea-\u003ei_state)  Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file         deleting process holds BASEHD's wbuf-\u003eio_mutex while getting the \txattr inode, which could race with inode reclaiming process(The         reclaiming process could try locking BASEHD's wbuf-\u003eio_mutex in \tinode evicting function), then an ABBA deadlock problem would \thappen as following:   1. File A has inode ia and a xattr(with inode ixa), regular file B has     inode ib and a xattr.  2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa  3. Then, following three processes running like this:          PA                PB                        PC                 echo 2 \u003e /proc/sys/vm/drop_caches                  shrink_slab                   prune_dcache_sb                   // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia                   prune_icache_sb                    list_lru_walk_one                     inode_lru_isolate                      ixa-\u003ei_state |= I_FREEING // set inode state                     inode_lru_isolate                      __iget(ib)                      spin_unlock(&ib-\u003ei_lock)                      spin_unlock(lru_lock)                                                    rm file B                                                     ib-\u003enlink = 0  rm file A   iput(ia)    ubifs_evict_inode(ia)     ubifs_jnl_delete_inode(ia)      ubifs_jnl_write_inode(ia)       make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex       ubifs_iget(ixa-\u003ei_ino)        iget_locked         find_inode_fast          __wait_on_freeing_inode(ixa)           |          iput(ib) // ib-\u003enlink is 0, do evict           |           ubifs_evict_inode           |            ubifs_jnl_delete_inode(ib)           ↓             ubifs_jnl_write_inode      ABBA deadlock ←-----make_reservation(BASEHD)                    dispose_list // cannot be executed by prune_icache_sb                     wake_up_bit(&ixa-\u003ei_state)  Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate( ---truncated---","modified":"2026-09-15T09:03:11.046311171Z","published":"2024-09-04T20:15:08.823Z","upstream":["CVE-2024-45003"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-45003"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.112-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-45003.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-45003.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-45003.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}