In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: always run deallocs on copy-on-write completion<\/p>\n
Local fuzzing of 6.12.94 has found the following memory leak
\ncaused by doing ‘copy_file_range()’ within the same filesystem:<\/p>\n
unreferenced object 0xffff88812192c980 (size 32):
\n comm “syz.0.49”, pid 12095, jiffies 4294964143
\n hex dump (first 32 bytes):
\n 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 …………….
\n c0 c5 92 21 81 88 ff ff 00 02 00 00 00 06 00 00 …!…………
\n backtrace (crc 7068d63f):
\n kmemleak_alloc_recursive include\/linux\/kmemleak.h:42 [inline]
\n slab_post_alloc_hook mm\/slub.c:4152 [inline]
\n slab_alloc_node mm\/slub.c:4197 [inline]
\n __kmalloc_cache_noprof+0x168\/0x2c0 mm\/slub.c:4358
\n kmalloc_noprof include\/linux\/slab.h:878 [inline]
\n ocfs2_find_per_slot_free_list fs\/ocfs2\/alloc.c:6618 [inline]
\n ocfs2_cache_block_dealloc+0x155\/0x4b0 fs\/ocfs2\/alloc.c:6786
\n ocfs2_cache_extent_block_free fs\/ocfs2\/alloc.c:6819 [inline]
\n ocfs2_unlink_path+0x286\/0x450 fs\/ocfs2\/alloc.c:2613
\n ocfs2_rotate_subtree_left fs\/ocfs2\/alloc.c:2779 [inline]
\n __ocfs2_rotate_tree_left+0x1f6f\/0x2da0 fs\/ocfs2\/alloc.c:2985
\n ocfs2_rotate_tree_left+0x283\/0xe00 fs\/ocfs2\/alloc.c:3237
\n ocfs2_try_to_merge_extent+0xf56\/0x1a20 fs\/ocfs2\/alloc.c:3825
\n ocfs2_split_extent+0x15f4\/0x2940 fs\/ocfs2\/alloc.c:5138
\n ocfs2_clear_ext_refcount+0x2f6\/0x550 fs\/ocfs2\/refcounttree.c:3098
\n ocfs2_replace_clusters fs\/ocfs2\/refcounttree.c:3131 [inline]
\n ocfs2_make_clusters_writable fs\/ocfs2\/refcounttree.c:3255 [inline]
\n ocfs2_replace_cow+0x991\/0x1660 fs\/ocfs2\/refcounttree.c:3349
\n ocfs2_refcount_cow_hunk fs\/ocfs2\/refcounttree.c:3427 [inline]
\n ocfs2_refcount_cow+0x5e1\/0x9f0 fs\/ocfs2\/refcounttree.c:3470
\n ocfs2_prepare_inode_for_write fs\/ocfs2\/file.c:2340 [inline]
\n ocfs2_file_write_iter+0xbda\/0x1880 fs\/ocfs2\/file.c:2451
\n iter_file_splice_write+0x890\/0xf60 fs\/splice.c:743
\n do_splice_from fs\/splice.c:944 [inline]
\n direct_splice_actor+0x232\/0x480 fs\/splice.c:1167
\n splice_direct_to_actor+0x4b4\/0xb60 fs\/splice.c:1111
\n do_splice_direct_actor fs\/splice.c:1210 [inline]
\n do_splice_direct+0x10f\/0x1c0 fs\/splice.c:1236
\n do_sendfile+0x430\/0xbf0 fs\/read_write.c:1388<\/p>\n
unreferenced object 0xffff88812192c5c0 (size 32):
\n comm “syz.0.49”, pid 12095, jiffies 4294964143
\n hex dump (first 32 bytes):
\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n 29 70 00 00 00 00 00 00 19 00 00 00 00 00 00 00 )p…………..
\n backtrace (crc afec850f):
\n kmemleak_alloc_recursive include\/linux\/kmemleak.h:42 [inline]
\n slab_post_alloc_hook mm\/slub.c:4152 [inline]
\n slab_alloc_node mm\/slub.c:4197 [inline]
\n __kmalloc_cache_noprof+0x168\/0x2c0 mm\/slub.c:4358
\n kmalloc_noprof include\/linux\/slab.h:878 [inline]
\n kzalloc_noprof include\/linux\/slab.h:1014 [inline]
\n ocfs2_cache_block_dealloc+0x25c\/0x4b0 fs\/ocfs2\/alloc.c:6793
\n ocfs2_cache_extent_block_free fs\/ocfs2\/alloc.c:6819 [inline]
\n ocfs2_unlink_path+0x286\/0x450 fs\/ocfs2\/alloc.c:2613
\n ocfs2_rotate_subtree_left fs\/ocfs2\/alloc.c:2779 [inline]
\n __ocfs2_rotate_tree_left+0x1f6f\/0x2da0 fs\/ocfs2\/alloc.c:2985
\n ocfs2_rotate_tree_left+0x283\/0xe00 fs\/ocfs2\/alloc.c:3237
\n ocfs2_try_to_merge_extent+0xf56\/0x1a20 fs\/ocfs2\/alloc.c:3825
\n ocfs2_split_extent+0x15f4\/0x2940 fs\/ocfs2\/alloc.c:5138
\n ocfs2_clear_ext_refcount+0x2f6\/0x550 fs\/ocfs2\/refcounttree.c:3098
\n ocfs2_replace_clusters fs\/ocfs2\/refcounttree.c:3131 [inline]
\n ocfs2_make_clusters_writable fs\/ocfs2\/refcounttree.c:3255 [inline]
\n ocfs2_replace_cow+0x991\/0x1660 fs\/ocfs2\/refcounttree.c:3349
\n ocfs2_refcount_cow_hunk fs\/ocfs2\/refcounttree.c:3427 [inline]
\n ocfs2_refcount_cow+0x5e1\/0x9f0 fs\/ocfs2\/refcounttree.c:3470
\n ocfs2_prepare_inode_for_write fs\/ocfs2\/file.c:2340 [inline]
\n ocfs2_file_write_iter+0xbda\/0x1880 fs\/ocfs2\/file.c:2451
\n iter_file_splice_write+0x890\/0xf60 fs\/splice.c:743
\n do_splice_from fs\/splice.c:9
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: always run deallocs on copy-on-write completion<\/p>\n
Local fuzzing of 6.12.94 has found the following memory leak
\ncaused by doin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21418","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}