Message-ID: <2024100906-CVE-2024-47669-135c@gregkh>
Date: Wed,  9 Oct 2024 16:14:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-47669: nilfs2: fix state management in error path of log writing function

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix state management in error path of log writing function

After commit a694291a6211 ("nilfs2: separate wait function from
nilfs_segctor_write") was applied, the log writing function
nilfs_segctor_do_construct() was able to issue I/O requests continuously
even if user data blocks were split into multiple logs across segments,
but two potential flaws were introduced in its error handling.

First, if nilfs_segctor_begin_construction() fails while creating the
second or subsequent logs, the log writing function returns without
calling nilfs_segctor_abort_construction(), so the writeback flag set on
pages/folios will remain uncleared.  This causes page cache operations to
hang waiting for the writeback flag.  For example,
truncate_inode_pages_final(), which is called via nilfs_evict_inode() when
an inode is evicted from memory, will hang.

Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. 
As a result, if the next log write involves checkpoint creation, that's
fine, but if a partial log write is performed that does not, inodes with
NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files"
list, and their data and b-tree blocks may not be written to the device,
corrupting the block mapping.

Fix these issues by uniformly calling nilfs_segctor_abort_construction()
on failure of each step in the loop in nilfs_segctor_do_construct(),
having it clean up logs and segment usages according to progress, and
correcting the conditions for calling nilfs_redirty_inodes() to ensure
that the NILFS_I_COLLECTED flag is cleared.

The Linux kernel CVE team has assigned CVE-2024-47669 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 4.19.322 with commit 40a2757de2c3
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 5.4.284 with commit 036441e8438b
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 5.10.226 with commit efdde00d4a1e
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 5.15.167 with commit 3e349d7191f0
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 6.1.110 with commit 30562eff4a6d
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 6.6.51 with commit 0a1a961bde43
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 6.10.10 with commit 74866c16ea21
	Issue introduced in 2.6.33 with commit a694291a6211 and fixed in 6.11 with commit 6576dd6695f2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-47669
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nilfs2/segment.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/40a2757de2c376ef8a08d9ee9c81e77f3c750adf
	https://git.kernel.org/stable/c/036441e8438b29111fa75008f0ce305fb4e83c0a
	https://git.kernel.org/stable/c/efdde00d4a1ef10bb71e09ebc67823a3d3ad725b
	https://git.kernel.org/stable/c/3e349d7191f0688fc9808ef24fd4e4b4ef5ca876
	https://git.kernel.org/stable/c/30562eff4a6dd35c4b5be9699ef61ad9f5f20a06
	https://git.kernel.org/stable/c/0a1a961bde4351dc047ffdeb2f1311ca16a700cc
	https://git.kernel.org/stable/c/74866c16ea2183f52925fa5d76061a1fe7f7737b
	https://git.kernel.org/stable/c/6576dd6695f2afca3f4954029ac4a64f82ba60ab

Powered by blists - more mailing lists