Shinichiro Kawasaki

A use-after-free vulnerability has been identified in the Linux kernel, specifically in the btrfs encoded read endio() function. This issue was reported by Shinichiro and occurs when running fstests' btrfs/284 on a TCMU runner device. The vulnerability is caused by a slab-use-after-free error in the lock release() function. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include: - The `btrfs encoded read endio()` function is vulnerable. - The `lock release()` function is also involved in the vulnerability. - The issue is related to a slab-use-after-free error.

The issue arises from the Linux kernel's handling of discard support for conventional zones on zoned block devices. The `f2fs bdev support discard()` function checks for discard support, but this check does not work correctly for conventional zones. As a result, ` submit discard cmd()` may call ` blkdev issue discard()` even when the device does not support discard, leading to a NULL pointer and triggering `f2fs bug on()`. This problem occurred after a commit changed the behavior of ` blkdev issue discard()` to no longer check for discard support.

The vulnerability is related to a potential parallel list adding issue in the btrfs reclaim bgs work function, which can cause list corruption and trigger a kernel bug. The issue can be reproduced when relocation cannot find more chunk space and ends with ENOSPC. The vulnerability is fixed by taking the fs info->unused bgs lock.

The issue is related to a NULL pointer dereference in the `btrfs zone finish endio()` function when running the `btrfs/167` test case on emulated zoned devices. This occurs because the `ordered extent` is missing a checksums list, which is expected when doing a NOCOW write. The `btrfs zone finish endio()` function is called when finishing an I/O operation on a zoned device. To exploit this issue, an attacker would need to be able to run the `btrfs/167` test case on an emulated zoned device, which may require specific hardware and software configurations.

The issue arises when the multi-devices feature is enabled in the Linux kernel, specifically with the f2fs file system. In this scenario, the `f2fs map blocks()` function may return a zero block address in non-primary devices, which is a valid block address. However, the `f2fs iomap begin()` function treats this as an invalid block address, triggering a warning in the iomap framework code. This warning is caught during the zbd/010 test, which checks for gap zone support with F2FS. The root cause of the issue is the incorrect assumption in `f2fs iomap begin()` about the physical block address of the whole f2fs file system. To fix this issue, a more direct approach is used, checking the `(map.m flags & F2FS MAP MAPPED)` condition instead of `(map.m pblk != NULL ADDR)`.

The issue is related to a use-after-free vulnerability in the `do zone finish()` function of the btrfs module. This vulnerability can be triggered by a device replace operation in fstests btrfs/070, causing a slab-use-after-free error. The sequence of events leading to this vulnerability involves the replacement of devices, freeing of a source device, and subsequent access to stale zone information of the removed device.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.8-rc7 Description: The issue is related to a double-free vulnerability in the `ns update nuse()` function, which can lead to a denial of service. When `nvme identify ns()` fails, it frees the pointer to the `struct nvme id ns` before returning. However, `ns update nuse()` calls `kfree()` for the pointer even when `nvme identify ns()` fails, resulting in a KASAN double-free error. This was observed with `blktests nvme/045` and proposed patches on kernel `v6.8-rc7`. The vulnerability can be exploited to cause a denial of service. Recommendations: To resolve the issue, update the Linux kernel to a version that includes the fix for the double-free vulnerability in `ns update nuse()`. As a temporary workaround, consider disabling the `ns update nuse()` function until a patch is available. Restrict access to the vulnerable `nvme` module to minimize the risk of exploitation. Avoid using the `nvme identify ns()` function in the affected kernel versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A deadlock vulnerability has been found in the Linux kernel, specifically in the btrfs file system. The issue occurs when the quota disable ioctl starts a transaction before waiting for the qgroup rescan worker to complete, resulting in a circular dependency among the quota disable ioctl, the qgroup rescan worker, and other tasks with transactions. This can lead to an infinite wait and a deadlock. The vulnerability was discovered using the fstests test case btrfs/115 and a zoned null blk device. An example report of the deadlock is provided, showing tasks blocked for more than 122 seconds.

A use-after-free issue was found in the Linux kernel, specifically in the fsl-mc-bus component. The problem occurs when `mc->root mc bus dev` is freed in `fsl mc device remove()`, but its `mc io` is still referenced and passed to `fsl destroy mc io()` in `fsl mc bus remove()`. This triggers a KASAN use-after-free error. The issue can be resolved by keeping a local reference to `mc->root mc bus dev->mc io` and passing it to `fsl destroy mc io()`.

A vulnerability has been resolved in the Linux kernel, specifically in the scsi: target: core, where the function smp processor id() was called in preemptible code, triggering a BUG message. This issue was observed when running blktests block/005 on TCMU devices with fileio backend or user:zbc backend, and also at system shutdown when TCMU devices were not cleaned up. The commit 1130b499b4a7 modified the work queue to handle commands and changed 'current->nr cpu allowed' at smp processor id() call, triggering the symptom. To avoid this issue, the CPU ID is now obtained with raw smp processor id() instead.