Ryusuke Konishi

A issue in the Linux kernel has been identified, specifically in the nilfs2 component. The `nilfs lookup dirty data buffers()` function accesses buffers attached to dirty data folios/pages without proper locking, potentially leading to use after free issues. This can occur when `nilfs clear folio dirty()` is called asynchronously, causing buffers to lose their dirty state protection and be unintentionally freed by `try to free buffers()`. The problem arises from a race condition that has been addressed by adjusting the lock section in the `nilfs lookup dirty data buffers()` function.

The issue is related to the nilfs2 file system in the Linux kernel, specifically with the function nilfs clear folio dirty() in the fs/nilfs2/page.c module. It is associated with a memory write beyond the allocated buffer. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. The problem arises when the "checked" flag of a page/folio is not cleared after it is discarded by nilfs2's own routine, causing the sanity check of directory entries to be skipped when the directory page/folio is reloaded.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A potential deadlock issue has been identified in the Linux kernel, specifically in the nilfs2 filesystem. This issue arises when creating new symlinks using the nilfs symlink() function, which can trigger memory reclamation involving the filesystem layer. This may result in circular lock dependencies among the reader/writer semaphore nilfs->ns segctor sem, s writers percpu rwsem (intwrite), and the fs reclaim pseudo lock. The issue occurs because the gfp flags of the page cache for symbolic links are overwritten to GFP KERNEL via inode nohighmem(). To fix this issue, the GFP FS flag is dropped from the page cache GFP flags of newly created symlinks. Recommendations: For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider dropping the GFP FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs new inode() and nilfs read inode() do.

The issue is related to the function `nilfs btree check delete()` in the nilfs2 module of the Linux kernel, which can cause memory access outside the block buffer when retrieving the maximum key if the root node has no entries. This can happen if the b-tree root node read from a device is configured that way. The problem is fixed by adding a check for that case.

A use-after-free bug was found in the Linux kernel's nilfs2 file system. The bug occurs when data recovery is performed using partial logs created by dsync writes, but an error occurs before starting the log writer to create a recovered checkpoint. As a result, the inodes whose data had been recovered are left in the ns dirty files list of the nilfs object and are not freed. This issue can be fixed by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts.

A state management issue in the nilfs2 log writing function has been resolved. The problem occurred after a commit was applied, allowing the log writing function `nilfs segctor do construct()` to issue I/O requests continuously even if user data blocks were split into multiple logs across segments. However, two potential flaws were introduced in its error handling. If `nilfs segctor begin construction()` fails while creating the second or subsequent logs, the log writing function returns without calling `nilfs segctor abort construction()`, causing page cache operations to hang waiting for the writeback flag. Additionally, the `NILFS I COLLECTED` flag set on normal inodes remains uncleared, potentially corrupting the block mapping.

The issue concerns the nilfs2 file system in the Linux kernel, where the superblock buffers can be overwritten, swapped, or abandoned due to various operations. Accessing these buffers requires mutual exclusion using the `nilfs->ns sem` reader/writer semaphore. However, some sysfs attribute show methods read the superblock buffer without this necessary mutual exclusion, leading to potential problems with pointer dereferencing and memory access.

A use-after-free vulnerability in the Linux kernel's nilfs2 filesystem has been resolved. The issue occurs when mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images, causing a kernel bug in `lru add fn()`. This is due to the link count of a metadata file getting corrupted to 0, and `nilfs evict inode()` trying to delete that inode. The inconsistency happens because directories containing the inode numbers of these metadata files are read without checking. The fix involves treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages.

The issue is related to the nilfs2 file system in the Linux kernel. Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine. This is because the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache without waiting for the ongoing folio/page writeback, resulting in an inconsistent writeback state. The fix involves waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state.

A vulnerability in the Linux kernel's nilfs2 file system is related to null pointer dereferences. This issue occurs when using the "block:block dirty buffer" tracepoint, which can cause a NULL pointer dereference or a general protection fault when KASAN is enabled. The problem arises because the tracepoint references the dev t member bh->b bdev->bd dev regardless of whether the buffer head has a pointer to a block device structure. The nilfs grab buffer() function does not set the block device, but instead does so only if the buffer is not in the "uptodate" state for each of its caller block reading functions. However, if the uptodate flag is set on a folio/page, and the buffer heads are detached from it by try to free buffers(), and new buffer heads are then attached by create empty buffers(), the uptodate flag may be restored to each buffer without the block device being set to bh->b bdev, and mark buffer dirty() may be called later in that state, resulting in the bug mentioned above.

The issue is related to the nilfs2 component of the Linux kernel, specifically with the `nilfs get block()` function. This function may return a successful status even when both searching and inserting a specified block fail, leading to inconsistent behavior. If this behavior is not due to a previously fixed bug, it may indicate an unexpected race condition, prompting the return of a temporary error `-EAGAIN`. This prevents certain callers, such as ` block write begin int()`, from requesting a read into an unmapped buffer, which could cause a `BUG ON` check for the `BH Mapped` flag in `submit bh wbc()` to fail.

The issue is related to the nilfs2 file system in the Linux kernel. Specifically, the helper function `nilfs recovery copy block()` of `nilfs recovery dsync blocks()` incorrectly calculates the on-page offset when copying repair data to the file's page cache. This flaw can cause data corruption and leak uninitialized memory bytes during the recovery process, particularly in environments where the block size is smaller than the page size.