{"id":"DEBIAN-CVE-2023-54271","details":"In the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init  blk-iocost sometimes causes the following crash:    BUG: kernel NULL pointer dereference, address: 00000000000000e0   ...   RIP: 0010:_raw_spin_lock+0x17/0x30   Code: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 \u003cf0\u003e 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00   RSP: 0018:ffffc900023b3d40 EFLAGS: 00010046   RAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001   RDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0   RBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003   R10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000   R13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600   FS:  00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0   Call Trace:    \u003cTASK\u003e    ioc_weight_write+0x13d/0x410    cgroup_file_write+0x7a/0x130    kernfs_fop_write_iter+0xf5/0x170    vfs_write+0x298/0x370    ksys_write+0x5f/0xb0    __x64_sys_write+0x1b/0x20    do_syscall_64+0x3d/0x80    entry_SYSCALL_64_after_hwframe+0x46/0xb0  This happens because iocg-\u003eioc is NULL. The field is initialized by ioc_pd_init() and never cleared. The NULL deref is caused by blkcg_activate_policy() installing blkg_policy_data before initializing it.  blkcg_activate_policy() was doing the following:  1. Allocate pd's for all existing blkg's and install them in blkg-\u003epd[]. 2. Initialize all pd's. 3. Online all pd's.  blkcg_activate_policy() only grabs the queue_lock and may release and re-acquire the lock as allocation may need to sleep. ioc_weight_write() grabs blkcg-\u003elock and iterates all its blkg's. The two can race and if ioc_weight_write() runs during #1 or between #1 and #2, it can encounter a pd which is not initialized yet, leading to crash.  The crash can be reproduced with the following script:    #!/bin/bash    echo +io \u003e /sys/fs/cgroup/cgroup.subtree_control   systemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct   echo 100 \u003e /sys/fs/cgroup/system.slice/io.weight   bash -c \"echo '8:0 enable=1' \u003e /sys/fs/cgroup/io.cost.qos\" &   sleep .2   echo 100 \u003e /sys/fs/cgroup/system.slice/io.weight  with the following patch applied:  \u003e diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c \u003e index fc49be622e05..38d671d5e10c 100644 \u003e --- a/block/blk-cgroup.c \u003e +++ b/block/blk-cgroup.c \u003e @@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol) \u003e \t\tpd-\u003eonline = false; \u003e \t} \u003e \u003e +       if (system_state == SYSTEM_RUNNING) { \u003e +               spin_unlock_irq(&q-\u003equeue_lock); \u003e +               ssleep(1); \u003e +               spin_lock_irq(&q-\u003equeue_lock); \u003e +       } \u003e + \u003e \t/* all allocated, init in the same order */ \u003e \tif (pol-\u003epd_init_fn) \u003e \t\tlist_for_each_entry_reverse(blkg, &q-\u003eblkg_list, q_node)  I don't see a reason why all pd's should be allocated, initialized and onlined together. The only ordering requirement is that parent blkgs to be initialized and onlined before children, which is guaranteed from the walking order. Let's fix the bug by allocating, initializing and onlining pd for each blkg and holding blkcg-\u003elock over initialization and onlining. This ensures that an installed blkg is always fully initialized and onlined removing the the race window.","modified":"2026-09-15T08:47:26.095468540Z","published":"2025-12-30T13:16:16Z","upstream":["CVE-2023-54271"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-54271"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.176-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54271.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54271.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54271.json"}}],"schema_version":"1.9.0"}