Executive Summary

This vulnerability exists in the Linux kernel's fsnotify subsystem, specifically in the fsnotify_recalc_mask() function. The function fails to properly handle the return value of __fsnotify_recalc_mask(), which can return an inode pointer that must be released using fsnotify_drop_object(). When the connector's HAS_IREF flag changes from set to cleared, this inode pointer is not released, causing an inode reference leak.

This leak can cause tasks to hang, as demonstrated by a blocked umount task in the kernel call trace. The root cause is a race condition between two threads: one adding a mark and another removing a mark. The transition of the HAS_IREF flag from true to false is mishandled, leading to the inode pointer not being freed and resulting in resource leakage.

The fix involves deferring the transition of the HAS_IREF flag from true to false from fsnotify_recalc_mask() to fsnotify_put_mark(), ensuring proper release of the inode pointer and preventing the leak.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause tasks in the Linux kernel to hang or become blocked for extended periods, as inode references are leaked and not properly released. This can lead to resource exhaustion, degraded system performance, or instability.

In practical terms, system operations such as unmounting filesystems may stall, potentially impacting system availability and reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a hung task with a specific call trace involving the umount task being blocked for more than 120 seconds.

To detect this issue on your system, you can look for hung tasks related to unmount operations and check kernel logs for call traces similar to the following:

• Look for messages like: "INFO: task umount:<pid> blocked for more than 120 seconds."
• Examine the kernel call trace for functions such as __schedule, schedule, fsnotify_sb_delete, generic_shutdown_super, kill_anon_super, cleanup_mnt, task_work_run, do_exit, and do_group_exit.

You can use commands like `dmesg | grep 'task umount'` or `journalctl -k | grep 'task umount'` to find relevant kernel log entries.

Additionally, monitoring hung or blocked tasks using tools like `ps`, `top`, or `htop` and checking for tasks stuck in uninterruptible sleep (D state) may help identify the problem.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is caused by an inode reference leak in the fsnotify_recalc_mask() function due to improper handling of the HAS_IREF flag transition.

Immediate mitigation involves applying the fix that defers the transition of the HAS_IREF flag from fsnotify_recalc_mask() to fsnotify_put_mark(), ensuring proper release of inode pointers.

Since this is a Linux kernel vulnerability, the recommended immediate step is to update your Linux kernel to a version that includes the patch resolving this issue.

If updating the kernel is not immediately possible, consider avoiding workloads or operations that trigger heavy use of fsnotify marks, such as frequent mount/unmount operations, until the patch can be applied.

Useful 0 Not Useful 0