In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nilfs2: reject invalid block index in GC ioctl<\/p>\n
Syzbot reported list corruption caused by a double list_add_tail() call on
\nbh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers().<\/p>\n
Analysis revealed that the root cause was the insertion of a page\/folio
\nwith a page index of ULONG_MAX into the page cache via the GC ioctl.
\nfilemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(),
\nrepeatedly detects a dirty folio with a page index of ULONG_MAX due to
\nindex wrap-around, leading to duplicate processing of dirty buffers.<\/p>\n
As a preparatory step, the GC ioctl loads the page\/folio of the block to
\nbe moved during GC and inserts it into the page cache based on information
\nin the nilfs_vdesc structure passed as an argument. Normally, this does
\nnot cause issues because the user-space GC library configures the
\nnilfs_vdesc structure properly. However, since there is no range check on
\nthe parameters determining the page index, a request with artificially
\ncrafted parameters — such as those generated by Syzbot — can result in a
\npage\/folio being inserted with a page index of ULONG_MAX, triggering the
\nabove problem.<\/p>\n
This resolves the issue by checking the ranges of ‘vd_offset’ and
\n‘vd_vblocknr’ in the nilfs_vdesc structure that determine the page index,
\nthereby preventing the invalid page\/folio insertions.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nilfs2: reject invalid block index in GC ioctl<\/p>\n
Syzbot reported list corruption caused by a double list_add_tail() call on
\nbh->b_as<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17311","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}