In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: avoid fs reclaim while using current->journal_info<\/p>\n
handle_reply() stores a `ceph_mds_request` pointer in
\n`current->journal_info` while filling the inode and dentry cache from
\nan MDS reply.<\/p>\n
An allocation in this section can enter direct reclaim and prune
\ndentries from another filesystem. If this dirties an ext4 inode, ext4
\nstarts a JBD2 transaction. JBD2 interprets the Ceph request in
\n`current->journal_info` as a journal handle and dereferences the
\nrequest’s `r_tid` as `h_transaction`, causing a kernel crash, e.g.:<\/p>\n
Unable to handle kernel paging request at virtual address 00000000077b4818
\n […]
\n Internal error: Oops: 0000000096000004 [#1] SMP
\n Modules linked in:
\n CPU: 6 UID: 0 PID: 2699135 Comm: kworker\/6:3 Tainted: G W 6.18.38-i3 #1113 NONE
\n […]
\n Workqueue: ceph-msgr ceph_con_workfn
\n pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=–)
\n pc : jbd2__journal_start+0x2c\/0x208
\n lr : __ext4_journal_start_sb+0x100\/0x178
\n […]
\n Call trace:
\n jbd2__journal_start+0x2c\/0x208 (P)
\n __ext4_journal_start_sb+0x100\/0x178
\n ext4_dirty_inode+0x3c\/0x90
\n __mark_inode_dirty+0x58\/0x400
\n iput.part.0+0x2b0\/0x370
\n iput+0x18\/0x30
\n dentry_unlink_inode+0xc0\/0x158
\n __dentry_kill+0x80\/0x250
\n shrink_dentry_list+0x90\/0x130
\n prune_dcache_sb+0x60\/0x98
\n super_cache_scan+0xe8\/0x190
\n do_shrink_slab+0x174\/0x388
\n shrink_slab+0xd8\/0x4c0
\n shrink_node+0x31c\/0x908
\n do_try_to_free_pages+0xd0\/0x508
\n try_to_free_pages+0x11c\/0x238
\n __alloc_frozen_pages_noprof+0x4d0\/0xdd0
\n __folio_alloc_noprof+0x18\/0x70
\n __filemap_get_folio+0x248\/0x440
\n ceph_readdir_prepopulate+0x570\/0x9e8
\n mds_dispatch+0x1424\/0x1ba0
\n ceph_con_process_message+0x74\/0xa0
\n ceph_con_v1_try_read+0x3a0\/0x1510
\n ceph_con_workfn+0x260\/0x460<\/p>\n
Enter a scoped NOFS allocation context and leave it after clearing
\n`journal_info`. This prevents filesystem reclaim from recursing into
\nanother filesystem while the field contains Ceph-private data.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: avoid fs reclaim while using current->journal_info<\/p>\n
handle_reply() stores a `ceph_mds_request` pointer in
\n`current->journal_i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11941","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}