From 5da19471e8ccc339b471370c2beb6da887754c41 Mon Sep 17 00:00:00 2001 From: Kent Overstreet Date: Sat, 10 Aug 2024 21:04:35 -0400 Subject: [PATCH] lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() BugLink: https://bugs.launchpad.net/bugs/2085849 [ Upstream commit b2f11c6f3e1fc60742673b8675c95b78447f3dae ] If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth before us, we'll still have a preallocated node that might be used later. If we then use that node for a new non-root node, it'll still have a pointer to the old root instead of being zeroed - fix this by zeroing it in the cmpxchg failure path. Signed-off-by: Kent Overstreet Signed-off-by: Sasha Levin CVE-2024-47668 Signed-off-by: Manuel Diewald Signed-off-by: Roxana Nicolescu --- lib/generic-radix-tree.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/generic-radix-tree.c b/lib/generic-radix-tree.c index 41f1bcdc4488..dd0163d8bb7a 100644 --- a/lib/generic-radix-tree.c +++ b/lib/generic-radix-tree.c @@ -132,6 +132,8 @@ void *__genradix_ptr_alloc(struct __genradix *radix, size_t offset, if ((v = cmpxchg_release(&radix->root, r, new_root)) == r) { v = new_root; new_node = NULL; + } else { + new_node->children[0] = NULL; } }