From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52807149DF6 for ; Wed, 3 Apr 2024 14:57:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712156230; cv=none; b=KfpISMdbV8sNBFAmLhmYR8QdWOlJg7JZQKtsX0j2buVi7t5Rx4AisJ3duCZzdR1w9eJr9bC+x4fv7t1gRhK59MWXjuJ7muIxqnIGhLyTJ9Jg4ccpOSbIC5ILUqbXpgL/Zqb0crIfgSIosPv2s4b6SF/En92724LML2B2lrlTozc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712156230; c=relaxed/simple; bh=qdZav0ipc++95OXVntahM8H72nm6g249bXtodZOLiEY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Y0DO6/VCSEeK1NSKejDyOKCbzoN1EuYFQha6Krgpz9vkwxOeLKd900yQSCDjWqQKwP4XL2DZfl5HOM1vH8X4Rf8WIpzLshrFgoIpzRL0sUqtTxDMGVK5EL8uFvxjuZj839ajnVELPlvicYidxL/pxbjIzrR23aLcNsoQYSG+1+c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GoPZ2MC3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GoPZ2MC3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBE6BC433C7; Wed, 3 Apr 2024 14:57:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1712156230; bh=qdZav0ipc++95OXVntahM8H72nm6g249bXtodZOLiEY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=GoPZ2MC3Fo0KIiz9vTAqtSUZwJGxXJtY1ST8Er/5Y4WZqx1z5qeEgIRUI79Sl1fv6 Oi6wA61QPd25QyqJaDipWcdagSW2kx2zDDy6ZYHAGFUx0WeqkDDEVa+Pig4YTwEYJ5 VzREuWtpwMaqOhNuc3I/Jh09cj9Wpsbn/p9EySIU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-26685: nilfs2: fix potential bug in end_buffer_async_write Date: Wed, 3 Apr 2024 16:55:36 +0200 Message-ID: <2024040335-CVE-2024-26685-e15e@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4181; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=qdZav0ipc++95OXVntahM8H72nm6g249bXtodZOLiEY=; b=owGbwMvMwCRo6H6F97bub03G02pJDGm8uc9lJ2nOzE7tv7bb+vCTWf6TV3/OYrw7O3216/0Jr 86+ifzW0xHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATeaHJsKBV+7D0wubPOw6H tF8r3n6gZKZIjivDgmVqzz06yx1COXa8MZ811a1p4TWhOAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer. The Linux kernel CVE team has assigned CVE-2024-26685 to this issue. Affected and fixed versions =========================== Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 4.19.307 with commit c4a09fdac625 Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.4.269 with commit d31c8721e816 Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.10.210 with commit f3e4963566f5 Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.15.149 with commit 8fa90634ec3e Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.1.79 with commit 6589f0f72f8e Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.6.18 with commit 2c3bdba00283 Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.7.6 with commit 626daab3811b Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.8 with commit 5bc09b397cbf Issue introduced in 3.2.52 with commit ccebcc74c81d Issue introduced in 3.4.83 with commit 831c87640d23 Issue introduced in 3.10.16 with commit d8974c7fe717 Issue introduced in 3.11.5 with commit 8f67918af09f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26685 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nilfs2/segment.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c4a09fdac625e64abe478dcf88bfa20406616928 https://git.kernel.org/stable/c/d31c8721e816eff5ca6573cc487754f357c093cd https://git.kernel.org/stable/c/f3e4963566f58726d3265a727116a42b591f6596 https://git.kernel.org/stable/c/8fa90634ec3e9cc50f42dd605eec60f2d146ced8 https://git.kernel.org/stable/c/6589f0f72f8edd1fa11adce4eedbd3615f2e78ab https://git.kernel.org/stable/c/2c3bdba00283a6c7a5b19481a59a730f46063803 https://git.kernel.org/stable/c/626daab3811b772086aef1bf8eed3ffe6f523eff https://git.kernel.org/stable/c/5bc09b397cbf1221f8a8aacb1152650c9195b02b