Theodore Tso

The issue arises when a block device is frozen before being claimed by a filesystem, and another process attempts to mount the frozen block device. This can cause a concurrent `fs bdev thaw()` call, leading to the mounter aborting the mounting process due to an elevated `bdev->bd fsfreeze count`. The `get bdev super()` function will return NULL in such cases. Technical details include the involvement of `dm suspend()` and `dm resume()` calls, which interact with `bdev freeze()` and `fs bdev thaw()` functions. Variables such as `bdev->bd fsfreeze count` play a crucial role in this process.

The issue arises when the call to `ext4 map blocks()` fails due to a corrupted file system, causing `ext4 ext replay set iblocks()` to get stuck in an infinite loop. This can be reproduced by running generic/526 with a file system that has `inline data` and `fast commit` enabled. The system will repeatedly log an EXT4-fs warning to the console, indicating a block greater than the maximum in an inode. The stack trace shows the functions involved, including `ext4 block to path()`, `ext4 ind map blocks()`, `ext4 map blocks()`, and others. The root cause is likely that `fast commit` replay is corrupting file systems with `inline data`, and better error handling is needed in the `fast commit` replay code path.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.

The issue allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media. This is due to the ext4 orphan del function in fs/ext4/namei.c not properly handling orphan-list entries for non-journal filesystems. Multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system can be exploited by a local attacker, potentially leading to breaches of confidentiality, integrity, and availability of protected information.