CVE-2026-89723: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

CVE-2026-89723: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
in nilfs_direct_propagate() during testing.

Analysis revealed that after truncating a file, a node block immediately
below the B-tree root was not deleted.  Instead, it remained in the B-tree
node cache in a dirty state.  The log writer subsequently detected this
block and incorrectly invoked nilfs_direct_propagate() on it, which is
designed to handle only data blocks in direct mapping.

B-tree nodes in the cache are managed by virtual block numbers, and their
logical keys typically exceed the range expected by direct mapping.
Consequently, processing such a node as a direct mapping entry triggers
a slab-out-of-bounds access.

The root cause is that when a B-tree mapping collapses into a direct
mapping during truncation, an intermediate node block pointed to by the
root node is left behind as garbage instead of being explicitly deleted.

This resolves the issue by adding a nilfs_btree_discard() operation
to delete the remaining intermediate node block during the conversion.
A 'deform' flag is added to the bop_delete interface to explicitly signal
that the deletion is part of a mapping transformation.  This allows the
B-tree mapping implementation to perform the necessary cleanup and
discarding of the residual node structure that would be otherwise be left
orphaned after the transition.

The Linux kernel CVE team has assigned CVE-2026-89723 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit 36a580eb489f54d81a0534974962e732a314b999 and fixed in 6.12.109 with commit 5d3783c451a546373662ee11ec17019273e68034
	Issue introduced in 2.6.30 with commit 36a580eb489f54d81a0534974962e732a314b999 and fixed in 6.18.50 with commit 448636c745a3f3b8582a0b8ce718c890a11c0fa9
	Issue introduced in 2.6.30 with commit 36a580eb489f54d81a0534974962e732a314b999 and fixed in 7.2.4 with commit 28362e8ce51377afdec1782e661e808328a10514
	Issue introduced in 2.6.30 with commit 36a580eb489f54d81a0534974962e732a314b999 and fixed in 7.3-rc1 with commit 45662dedb8f272ef7f16e69f13424c4bd0399240

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89723
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nilfs2/bmap.c
	fs/nilfs2/bmap.h
	fs/nilfs2/btree.c
	fs/nilfs2/direct.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034
	https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9
	https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514
	https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240