CVE-2023-53111

Description

In the Linux kernel, the following vulnerability has been resolved: loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20

Reserved 2025-05-02 | Published 2025-05-02 | Updated 2025-05-04 | Assigner Linux

Product status

Default status
unaffected

bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 407badf73ec9fb0d5744bf2ca1745c1818aa222f
affected

bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before e3fda704903f6d1fc351412f1bc6620333959ada
affected

bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 6917395c4667cfb607ed8bf1826205a59414657c
affected

bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 9b0cb770f5d7b1ff40bea7ca385438ee94570eec
affected

Default status
affected

4.4
affected

Any version before 4.4
unaffected

5.15.104
unaffected

6.1.21
unaffected

6.2.8
unaffected

6.3
unaffected

References

git.kernel.org/...c/407badf73ec9fb0d5744bf2ca1745c1818aa222f

git.kernel.org/...c/e3fda704903f6d1fc351412f1bc6620333959ada

git.kernel.org/...c/6917395c4667cfb607ed8bf1826205a59414657c

git.kernel.org/...c/9b0cb770f5d7b1ff40bea7ca385438ee94570eec

cve.org (CVE-2023-53111)

nvd.nist.gov (CVE-2023-53111)

Download JSON