From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDBF01F8755 for ; Wed, 16 Apr 2025 14:13:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812824; cv=none; b=C+vLgyiMLtY38rb3eAQ759+rhCsF4Z2qN2jV1Nu0x/n4W6TcHRYTcnwdixTE+Th8LVgXgieK8nX+Q0y1JrcTwD5bPogymCknhBY1AKxkRHEo0qtDtDR6bnTAk88I7sN6vyirlATNEOVKUUeUQowvPRtxk65J9gneD33S3Ltk8fE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812824; c=relaxed/simple; bh=9EW9NnhOPWaa2ImoRwhqzKr600WNH+t5fkQAvnU6NHY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RrczvruFTSLad3ymm+k2MzJaKy5P4DNmiLMue/0lDXdGLJpfSUopZp0iAEQqo/nD1ribZ72qe/sUVlAMQGN9N0SiOao/heSqczfjSouvGEogJgbgROHjvGG+3CWHDj87uI1cZ5dNDlOHLCZZN1NGQpvAYlEyHN3jS7Uk2OtDJIo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Au/BhmYq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Au/BhmYq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56477C4CEE2; Wed, 16 Apr 2025 14:13:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744812823; bh=9EW9NnhOPWaa2ImoRwhqzKr600WNH+t5fkQAvnU6NHY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Au/BhmYqevqxC29fbS9x2aO1ult3AqVTO0UcwSCGZqUE0JW+ZJIDJmUndoKEJRNNx 4b6myeOT+7DCAMvxXguiSmwXK+GaI4pyxE6pYzeD9LOyD7yha/Ed5sf9qnWO+9Z/jO Pudc6uT8LFmNQd1LGiWPEkxOhQNdbdgkbAbVqLtE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Date: Wed, 16 Apr 2025 16:12:01 +0200 Message-ID: <2025041656-CVE-2025-22030-ff28@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3861; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=9EW9NnhOPWaa2ImoRwhqzKr600WNH+t5fkQAvnU6NHY=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn/d63RcP55ledD3tGuTf8+ltXem/3nu/q9IIu+B3yOD X9eplwV6ohlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJOHQwzM/ZGVXmOsnQcerF /IK2J4JuxmznBBkW3Nw9zbPeOs7x/tOQjNCXOlLnU2PsAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() then holds scomp_lock (through crypto_exit_scomp_ops_async()). On the other hand, crypto_alloc_acomp_node() holds the scomp_lock (through crypto_scomp_init_tfm()), and then allocates memory. If the allocation results in reclaim, we may attempt to hold the per-CPU acomp_ctx mutex. The above dependencies can cause an ABBA deadlock. For example in the following scenario: (1) Task A running on CPU #1: crypto_alloc_acomp_node() Holds scomp_lock Enters reclaim Reads per_cpu_ptr(pool->acomp_ctx, 1) (2) Task A is descheduled (3) CPU #1 goes offline zswap_cpu_comp_dead(CPU #1) Holds per_cpu_ptr(pool->acomp_ctx, 1)) Calls crypto_free_acomp() Waits for scomp_lock (4) Task A running on CPU #2: Waits for per_cpu_ptr(pool->acomp_ctx, 1) // Read on CPU #1 DEADLOCK Since there is no requirement to call crypto_free_acomp() with the per-CPU acomp_ctx mutex held in zswap_cpu_comp_dead(), move it after the mutex is unlocked. Also move the acomp_request_free() and kfree() calls for consistency and to avoid any potential sublte locking dependencies in the future. With this, only setting acomp_ctx fields to NULL occurs with the mutex held. This is similar to how zswap_cpu_comp_prepare() only initializes acomp_ctx fields with the mutex held, after performing all allocations before holding the mutex. Opportunistically, move the NULL check on acomp_ctx so that it takes place before the mutex dereference. The Linux kernel CVE team has assigned CVE-2025-22030 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12.12 with commit 8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1 and fixed in 6.12.23 with commit 747e3eec1d7d124ea90ed3d7b85369df8b4e36d2 Issue introduced in 6.13 with commit 12dcb0ef540629a281533f9dedc1b6b8e14cfb65 and fixed in 6.13.11 with commit a8d18000e9d2d97aaf105f5f9b3b0e8a6fbf8b96 Issue introduced in 6.13 with commit 12dcb0ef540629a281533f9dedc1b6b8e14cfb65 and fixed in 6.14.2 with commit 717d9c35deff6c33235693171bacbb03e9643fa4 Issue introduced in 6.13 with commit 12dcb0ef540629a281533f9dedc1b6b8e14cfb65 and fixed in 6.15-rc1 with commit c11bcbc0a517acf69282c8225059b2a8ac5fe628 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-22030 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: mm/zswap.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/747e3eec1d7d124ea90ed3d7b85369df8b4e36d2 https://git.kernel.org/stable/c/a8d18000e9d2d97aaf105f5f9b3b0e8a6fbf8b96 https://git.kernel.org/stable/c/717d9c35deff6c33235693171bacbb03e9643fa4 https://git.kernel.org/stable/c/c11bcbc0a517acf69282c8225059b2a8ac5fe628