linux-cve-announce - CVE-2023-53593: cifs: Release folio lock on fscache read hit.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100428-CVE-2023-53593-228d@gregkh>
Date: Sat,  4 Oct 2025 17:51:47 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53593: cifs: Release folio lock on fscache read hit.

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cifs: Release folio lock on fscache read hit.

Under the current code, when cifs_readpage_worker is called, the call
contract is that the callee should unlock the page. This is documented
in the read_folio section of Documentation/filesystems/vfs.rst as:

> The filesystem should unlock the folio once the read has completed,
> whether it was successful or not.

Without this change, when fscache is in use and cache hit occurs during
a read, the page lock is leaked, producing the following stack on
subsequent reads (via mmap) to the page:

$ cat /proc/3890/task/12864/stack
[<0>] folio_wait_bit_common+0x124/0x350
[<0>] filemap_read_folio+0xad/0xf0
[<0>] filemap_fault+0x8b1/0xab0
[<0>] __do_fault+0x39/0x150
[<0>] do_fault+0x25c/0x3e0
[<0>] __handle_mm_fault+0x6ca/0xc70
[<0>] handle_mm_fault+0xe9/0x350
[<0>] do_user_addr_fault+0x225/0x6c0
[<0>] exc_page_fault+0x84/0x1b0
[<0>] asm_exc_page_fault+0x27/0x30

This requires a reboot to resolve; it is a deadlock.

Note however that the call to cifs_readpage_from_fscache does mark the
page clean, but does not free the folio lock. This happens in
__cifs_readpage_from_fscache on success. Releasing the lock at that
point however is not appropriate as cifs_readahead also calls
cifs_readpage_from_fscache and *does* unconditionally release the lock
after its return. This change therefore effectively makes
cifs_readpage_worker work like cifs_readahead.

The Linux kernel CVE team has assigned CVE-2023-53593 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.14.324 with commit c3ac8323f2f5b50e32681c254b8318f7fa2dc3f4
	Fixed in 4.19.293 with commit 5a87735675147f848445f05fd1f06168188f91af
	Fixed in 5.4.255 with commit 4259dd534245579c966c53c15187cc8e9461d6e9
	Fixed in 5.10.192 with commit 6e74926ede96470be84e66a1c576982fe4f8ea79
	Fixed in 5.15.128 with commit 961f7ce16223aee2db583a43877d84e6d1f2b857
	Fixed in 6.1.47 with commit 9e725386d4262ef23ae51993f04602bc535b5be2
	Fixed in 6.4.12 with commit 7a9fb689c1a1dc373887621a3bfa3810df0abde4
	Fixed in 6.5 with commit 69513dd669e243928f7450893190915a88f84a2b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53593
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/file.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c3ac8323f2f5b50e32681c254b8318f7fa2dc3f4
	https://git.kernel.org/stable/c/5a87735675147f848445f05fd1f06168188f91af
	https://git.kernel.org/stable/c/4259dd534245579c966c53c15187cc8e9461d6e9
	https://git.kernel.org/stable/c/6e74926ede96470be84e66a1c576982fe4f8ea79
	https://git.kernel.org/stable/c/961f7ce16223aee2db583a43877d84e6d1f2b857
	https://git.kernel.org/stable/c/9e725386d4262ef23ae51993f04602bc535b5be2
	https://git.kernel.org/stable/c/7a9fb689c1a1dc373887621a3bfa3810df0abde4
	https://git.kernel.org/stable/c/69513dd669e243928f7450893190915a88f84a2b