linux-kernel - [PATCH -mm] nilfs2: make block erasure safe in nilfs_finish_roll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20240511002942.9608-1-konishi.ryusuke@gmail.com>
Date: Sat, 11 May 2024 09:29:42 +0900
From: Ryusuke Konishi <konishi.ryusuke@...il.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-nilfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH -mm] nilfs2: make block erasure safe in nilfs_finish_roll_forward()

The implementation of writing a zero-fill block in
nilfs_finish_roll_forward() is not safe.  The buffer is being cleared
without acquiring a lock or setting the uptodate flag, so
theoretically, between the time the buffer's data is cleared and the
time it is written back to the block device using sync_dirty_buffer(),
that zero data can be undone by concurrent block device reads.

Since this buffer points to a location that has been read from disk
once, the uptodate flag will most likely remain, but since it was
obtained with __getblk(), that is not guaranteed.  In other words,
this is exceptional, and this function itself is not normally called
(only once when mounting after a specific pattern of unclean
shutdown), so it is highly unlikely that this will actually cause a
problem.

Anyway, eliminate this potential race issue by protecting the clearing
of buffer data with a buffer lock and setting the buffer's uptodate
flag within the protected section.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@...il.com>
---
Andrew, please add another patch to your queue for the next cycle
(or as a bug fix if it's late).  It eliminates one potential race issue.

Thanks,
Ryusuke Konishi

 fs/nilfs2/recovery.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 020f304c600e..b638dc06df2f 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -702,8 +702,12 @@ static void nilfs_finish_roll_forward(struct the_nilfs *nilfs,
 	if (WARN_ON(!bh))
 		return;  /* should never happen */

+	lock_buffer(bh);
 	memset(bh->b_data, 0, bh->b_size);
+	set_buffer_uptodate(bh);
 	set_buffer_dirty(bh);
+	unlock_buffer(bh);
+
 	err = sync_dirty_buffer(bh);
 	if (unlikely(err))
 		nilfs_warn(nilfs->ns_sb,
-- 
2.34.1