In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: stop retrying saturated xattr cache entries<\/p>\n
ext4_xattr_block_set() retries when a cache entry selected for reuse
\nhas a saturated reference count after taking the buffer lock. The retry
\nreturns to the mbcache lookup without making that entry ineligible, so
\nit can select the same unusable entry indefinitely. A task spinning
\nthere can hold the parent directory’s i_rwsem and leave concurrent
\nrmdir callers blocked.<\/p>\n
Normally a reusable entry has a reference count below
\nEXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are
\nupdated under the same buffer lock. A corrupted filesystem can violate
\nthat invariant. The syzbot reproducer reports allocator and xattr
\ncorruption before triggering this retry loop.<\/p>\n
Check the untrusted on-disk count before incrementing it, avoiding
\noverflow, and clear MBE_REUSABLE_B when it is already saturated. The
\nnext lookup then skips the entry that was just proven unusable. This
\nmirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX; the release
\npath marks the entry reusable again on the exact 1024-to-1023
\ntransition.<\/p>\n
Using the same QEMU harness and guest parameters, current unpatched
\nLinux hung in 6 of 8 420-second trials with the do_rmdir signature;
\nrepresentative NMI backtraces caught the owner spinning in
\next4_xattr_block_set(). The patched kernel completed 28 of 28 trials
\nwithout a hung-task report; the final twelve trials exercised the
\nreviewed overflow-safe form of the change. syzbot’s patch testing also
\ncompleted without reproducing the hang.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: stop retrying saturated xattr cache entries<\/p>\n
ext4_xattr_block_set() retries when a cache entry selected for reuse
\nhas a satur<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17312","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}