CVE-2023-53299

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix leak of 'r10bio->remaining' for recovery

raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_write() returns without issuing the write io, in this case, end_sync_request() is only called once and 'remaining' is leaked, cause an io hang.

Fix the problem by decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid.

RAID10 recovery could leak the r10bio->remaining counter on read failure, preventing completion and causing an I/O hang. The fix decrements the counter only for actually issued bios, avoiding the stall. This is a reliability bug, not remotely triggerable: it requires a RAID10 in recovery and device read errors, typically under administrative control. Impact is limited to availability (local I/O DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.