In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential bug in end_buffer_async_write
According to a syzbot report, end_buffer_async_write(), which handles the
completion of block device writes, may detect abnormal condition of the
buffer async_write flag and cause a BUG_ON failure when using nilfs2.
Nilfs2 itself does not use end_buffer_async_write(). But, the async_write
flag is now used as a marker by commit 7f42ec394156 (“nilfs2: fix issue
with race condition of competition between segments for dirty blocks”) as
a means of resolving double list insertion of dirty blocks in
nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the
resulting crash.
This modification is safe as long as it is used for file data and b-tree
node blocks where the page caches are independent. However, it was
irrelevant and redundant to also introduce async_write for segment summary
and super root blocks that share buffers with the backing device. This
led to the possibility that the BUG_ON check in end_buffer_async_write
would fail as described above, if independent writebacks of the backing
device occurred in parallel.
The use of async_write for segment summary buffers has already been
removed in a previous change.
Fix this issue by removing the manipulation of the async_write flag for
the remaining super root block buffer.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "c4a09fdac625",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "d31c8721e816",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "f3e4963566f5",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "8fa90634ec3e",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "6589f0f72f8e",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "2c3bdba00283",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "626daab3811b",
"versionType": "git"
},
{
"status": "affected",
"version": "7f42ec394156",
"lessThan": "5bc09b397cbf",
"versionType": "git"
}
],
"programFiles": [
"fs/nilfs2/segment.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.12",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.19.307",
"versionType": "custom",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.269",
"versionType": "custom",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.210",
"versionType": "custom",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.149",
"versionType": "custom",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.79",
"versionType": "custom",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.18",
"versionType": "custom",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.7.6",
"versionType": "custom",
"lessThanOrEqual": "6.7.*"
},
{
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/nilfs2/segment.c"
],
"defaultStatus": "affected"
}
]
git.kernel.org/stable/c/2c3bdba00283a6c7a5b19481a59a730f46063803
git.kernel.org/stable/c/5bc09b397cbf1221f8a8aacb1152650c9195b02b
git.kernel.org/stable/c/626daab3811b772086aef1bf8eed3ffe6f523eff
git.kernel.org/stable/c/6589f0f72f8edd1fa11adce4eedbd3615f2e78ab
git.kernel.org/stable/c/8fa90634ec3e9cc50f42dd605eec60f2d146ced8
git.kernel.org/stable/c/c4a09fdac625e64abe478dcf88bfa20406616928
git.kernel.org/stable/c/d31c8721e816eff5ca6573cc487754f357c093cd
git.kernel.org/stable/c/f3e4963566f58726d3265a727116a42b591f6596
lists.debian.org/debian-lts-announce/2024/06/msg00017.html
lists.debian.org/debian-lts-announce/2024/06/msg00020.html