PT-2026-52019 · Linux · Linux
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-53125
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
md: fix array state=clear sysfs deadlock
When "clear" is written to array state, md attr store() breaks sysfs
active protection so the array can delete itself from its own sysfs
store method.
However, md attr store() currently drops the mddev reference before
calling sysfs unbreak active protection(). Once do md stop(..., 0)
has made the mddev eligible for delayed deletion, the temporary
kobject reference taken by sysfs break active protection() can become
the last kobject reference protecting the md kobject.
That allows sysfs unbreak active protection() to drop the last
kobject reference from the current sysfs writer context. kobject
teardown then recurses into kernfs removal while the current sysfs
node is still being unwound, and lockdep reports recursive locking on
kn->active with kernfs drain() in the call chain.
Reproducer on an existing level:
- Create an md0 linear array and activate it: mknod /dev/md0 b 9 0 echo none > /sys/block/md0/md/metadata version echo linear > /sys/block/md0/md/level echo 1 > /sys/block/md0/md/raid disks echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new dev echo "$(($(cat /sys/class/block/sdb/size) / 2))" > /sys/block/md0/md/dev-sdb/size echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array state
- Wait briefly for the array to settle, then clear it: sleep 2 echo clear > /sys/block/md0/md/array state
The warning looks like:
WARNING: possible recursive locking detected
bash/588 is trying to acquire lock:
(kn->active#65) at kernfs remove+0x157/0x1d0
but task is already holding lock:
(kn->active#65) at sysfs unbreak active protection+0x1f/0x40
...
Call Trace:
kernfs drain
kernfs remove
kernfs remove by name ns
sysfs remove group
sysfs remove groups
kobject del
kobject put
md attr store
kernfs fop write iter
vfs write
ksys write
Restore active protection before mddev put() so the extra sysfs
kobject reference is dropped while the mddev is still held alive. The
actual md kobject deletion is then deferred until after the sysfs
write path has fully returned.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux