CVE-2024-56588 in Linux
Résumé
par VulDB • 18/06/2026
Based on the kernel panic trace and the provided solution description, here is an analysis of the issue and the recommended fix.
### Problem Analysis
The kernel crash occurs in the `hisi_sas_v3_hw` driver when a user writes to a debugfs file (`debugfs_trigger_dump_v3_hw_write`). The call trace shows:
1. **User Action**: A write syscall (`__arm64_sys_write`) is made to a debugfs entry. 2. **Driver Entry**: `debugfs_trigger_dump_v3_hw_write` is called. 3. **Crash Point**: The crash happens in `debugfs_create_dir` -> `start_creating` -> `down_write`.
**Root Cause**: The driver is attempting to **create debugfs directories/files dynamically** at runtime (specifically during the dump trigger) instead of creating them once during driver initialization. The `down_write` lock in `debugfs_create_dir` is likely failing due to: - A race condition with other debugfs operations. - Attempting to create a directory that already exists or is being modified. - Memory allocation failure during the dynamic creation. - Invalid state in the debugfs subsystem when creating nodes outside of the initialization phase.
### Recommended Fix
As stated in the prompt, the correct approach is to **pre-create all debugfs directories and files during driver initialization**. This ensures that: 1. The debugfs hierarchy is stable and fully established before any user-space interaction. 2. The driver only needs to **write data** to pre-existing files during the dump trigger, avoiding any dynamic file system operations.
### Implementation Steps
#### 1. Modify Driver Initialization (`hisi_sas_init` or similar)
Create all necessary debugfs directories and files when the driver loads.
```c static struct dentry *hisas_debugfs_root;
static int hisas_debugfs_init(struct hisi_hba *hisi_hba) {
struct dentry *dir; int ret;
/* Create root directory for this driver */ hisas_debugfs_root = debugfs_create_dir("hisi_sas_v3_hw", NULL); if (!hisas_debugfs_root) {
dev_err(hisi_hba->dev, "Failed to create debugfs root\n"); return -ENOMEM; }
/* Create subdirectories if needed */ dir = debugfs_create_dir("regs", hisas_debugfs_root); if (!dir) {
ret = -ENOMEM; goto err_remove_root; }
/* Create the trigger dump file */ debugfs_create_file("trigger_dump", 0220, hisas_debugfs_root, hisi_hba, &trigger_dump_fops); if (!debugfs_file_exists(debugfs_lookup("trigger_dump", hisas_debugfs_root))) {
ret = -ENOMEM; goto err_remove_regs; }
/* Create other debugfs entries as needed */ // ...
return 0;
err_remove_regs: debugfs_remove_recursive(dir); err_remove_root: debugfs_remove_recursive(hisas_debugfs_root); return ret; } ```
#### 2. Modify the Dump Trigger Function
Instead of creating files, simply write the register dump data to the pre-existing file.
```c static ssize_t debugfs_trigger_dump_v3_hw_write(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) {
struct hisi_hba *hisi_hba = file->private_data; char *buf; size_t buf_size; ssize_t ret;
/* Allocate buffer for the dump data */ buf_size = HISI_SAS_REG_DUMP_SIZE; buf = kmalloc(buf_size, GFP_KERNEL); if (!buf) return -ENOMEM;
/* Read register dump data into buffer */ ret = hisi_sas_read_regs(hisi_hba, buf, buf_size); if (ret) {
kfree(buf); return ret; }
/* Write the data to a pre-existing debugfs file (e.g., "reg_dump") */ /* Note: You may need to create a separate file for the dump output */ /* Or, if using a single file, you might need to handle truncation carefully */ /* Example: Write to a separate file "reg_dump" */ struct dentry *dump_file = debugfs_lookup("reg_dump", hisas_debugfs_root); if (dump_file) {
struct file *filp; mm_segment_t old_fs
VulDB is the best source for vulnerability data and more expert information about this specific topic.