{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix dentry leak in cachefiles_open_file()\n\nA dentry leak may be caused when a lookup cookie and a cull are concurrent:\n\n            P1             |             P2\n-----------------------------------------------------------\ncachefiles_lookup_cookie\n  cachefiles_look_up_object\n    lookup_one_positive_unlocked\n     // get dentry\n                            cachefiles_cull\n                              inode->i_flags |= S_KERNEL_FILE;\n    cachefiles_open_file\n      cachefiles_mark_inode_in_use\n        __cachefiles_mark_inode_in_use\n          can_use = false\n          if (!(inode->i_flags & S_KERNEL_FILE))\n            can_use = true\n\t  return false\n        return false\n        // Returns an error but doesn't put dentry\n\nAfter that the following WARNING will be triggered when the backend folder\nis umounted:\n\n==================================================================\nBUG: Dentry 000000008ad87947{i=7a,n=Dx_1_1.img}  still in use (1) [unmount of ext4 sda]\nWARNING: CPU: 4 PID: 359261 at fs/dcache.c:1767 umount_check+0x5d/0x70\nCPU: 4 PID: 359261 Comm: umount Not tainted 6.6.0-dirty #25\nRIP: 0010:umount_check+0x5d/0x70\nCall Trace:\n <TASK>\n d_walk+0xda/0x2b0\n do_one_tree+0x20/0x40\n shrink_dcache_for_umount+0x2c/0x90\n generic_shutdown_super+0x20/0x160\n kill_block_super+0x1a/0x40\n ext4_kill_sb+0x22/0x40\n deactivate_locked_super+0x35/0x80\n cleanup_mnt+0x104/0x160\n==================================================================\n\nWhether cachefiles_open_file() returns true or false, the reference count\nobtained by lookup_positive_unlocked() in cachefiles_look_up_object()\nshould be released.\n\nTherefore release that reference count in cachefiles_look_up_object() to\nfix the above issue and simplify the code."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/cachefiles/namei.c"
               ],
               "versions": [
                  {
                     "version": "1f08c925e7a3",
                     "lessThan": "d32ff64c872d",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f08c925e7a3",
                     "lessThan": "c7d10fa7d769",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f08c925e7a3",
                     "lessThan": "e4a28489b310",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f08c925e7a3",
                     "lessThan": "7fa2382f9742",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f08c925e7a3",
                     "lessThan": "da6ef2dffe60",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/cachefiles/namei.c"
               ],
               "versions": [
                  {
                     "version": "5.17",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.17",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.113",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.55",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.10.14",
                     "lessThanOrEqual": "6.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.11.3",
                     "lessThanOrEqual": "6.11.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.12-rc2",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/d32ff64c872d7e08e893c32ba6a2374583444410"
            },
            {
               "url": "https://git.kernel.org/stable/c/c7d10fa7d7691558ff967668494672415f5fa151"
            },
            {
               "url": "https://git.kernel.org/stable/c/e4a28489b310339b2b8187bec0a437709be551c1"
            },
            {
               "url": "https://git.kernel.org/stable/c/7fa2382f97421978514a419c93054eca69f5247b"
            },
            {
               "url": "https://git.kernel.org/stable/c/da6ef2dffe6056aad3435e6cf7c6471c2a62187c"
            }
         ],
         "title": "cachefiles: fix dentry leak in cachefiles_open_file()",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-49870",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}