CVE-2024-26956
Assigner: Linux
Published: 2024-05-01T05:18:56.101Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix failure to detect DAT corruption in btree and direct mappings

Patch series "nilfs2: fix kernel bug at submit_bh_wbc()".

This resolves a kernel BUG reported by syzbot.  Since there are two
flaws involved, I've made each one a separate patch.

The first patch alone resolves the syzbot-reported bug, but I think
both fixes should be sent to stable, so I've tagged them as such.


This patch (of 2):

Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data
to a nilfs2 file system whose metadata is corrupted.

There are two flaws involved in this issue.

The first flaw is that when nilfs_get_block() locates a data block using
btree or direct mapping, if the disk address translation routine
nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata
corruption, it can be passed back to nilfs_get_block().  This causes
nilfs_get_block() to misidentify an existing block as non-existent,
causing both data block lookup and insertion to fail inconsistently.

The second flaw is that nilfs_get_block() returns a successful status in
this inconsistent state.  This causes the caller __block_write_begin_int()
or others to request a read even though the buffer is not mapped,
resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()
failing.

This fixes the first issue by changing the return value to code -EINVAL
when a conversion using DAT fails with code -ENOENT, avoiding the
conflicting condition that leads to the kernel bug described above.  Here,
code -EINVAL indicates that metadata corruption was detected during the
block lookup, which will be properly handled as a file system error and
converted to -EIO when passing through the nilfs2 bmap layer.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: c3a7abf06ce7
lessThan: b67189690eb4
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: 9cbe1ad5f435
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: c3b5c5c31e72
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: 2e2619ff5d0d
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: 46b832e09d43
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: f69e81396aea
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: a8e4d098de1c
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: 82827ca21e7c
status: affected
versionType: git
version: c3a7abf06ce7
lessThan: f2f26b4a84a0
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 2.6.31
status: affected
version: 0
lessThan: 2.6.31
status: unaffected
versionType: custom
version: 4.19.312
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.274
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.215
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.154
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.84
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.24
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.12
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8.3
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: nilfs2: fix failure to detect DAT corruption in btree and direct mappings
x_generator: engine: bippy-d175d3acf727