🛡️ AZL-40322 — hyperv-daemons

CVE-2024-27058 affecting package hyperv-daemons for versions less than 6.6.29.1-1

In the Linux kernel, the following vulnerability has been resolved:

tmpfs: fix race on handling dquot rbtree

A syzkaller reproducer found a race while attempting to remove dquot

information from the rb tree.

Fetching the rb_tree root node must also be protected by the

dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot()

will trigger a warning because it couldn't find a node in the tree, when

the real reason was the root node changing before the search starts:

Thread 1 Thread 2

• shmem_release_dquot() - shmem_{acquire,release}_dquot()
• fetch ROOT - Fetch ROOT
• acquire dqio_sem
• wait dqio_sem
• do something, triger a tree rebalance
• release dqio_sem
• acquire dqio_sem
• start searching for the node, but

from the wrong location, missing

the node, and triggering a warning.