In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: write-protect folios during data writeback<\/p>\n
commit 095be159f3eb (“btrfs: unify folio dirty flag clearing”) replaced
\nthe folio_clear_dirty_for_io() call in extent_write_cache_pages() with a
\nplain folio_test_dirty() check. Besides clearing the dirty flag,
\nfolio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects
\nthe shared mmap PTEs mapping the folio. Note that we still do call
\nfolio_clear_dirty_for_io() later in submit_one_sector() when we clear
\ndirty on the last sector of the folio (the only sector for non-subpage
\ncases). But we lost this early call in extent_write_cache_pages().<\/p>\n
Without the extra write-protection, a process with the file mmap-ed can
\nmodify a sector while it is being used by writeback in a way that
\nexpects a stable folio (checksumming, compressing, copying, etc…)
\nwithout faulting, which manifests as a handful of concrete bugs.<\/p>\n
1. For large folios or subpage sectorsize, it is possible to submit a bio
\nwhich does not cover the whole folio. When this happens, we will have a
\nbio in flight for a folio that we have *not* called
\nfolio_clear_dirty_for_io() on. If a task with an existing mmap-ed PTE
\nwrites (without faulting..) in this window, it can result in
\ncorruptions. If the write arrives while the checksumming or writing itself
\nis underway, this can result in an invalid checksum and later corruption
\nreports on read. If the write arrives after checksumming\/writing is done
\nbut before the last sector dirty is cleared, then the write is present
\nin page cache but doesn’t affect the dirty tracking and will be lost
\nwhen the folio is fully finished being submitted and the dirty bit
\nis cleared. This results in losing the write even if fsync() is called.<\/p>\n
2. For zoned submissions which are done in batch separate from the main
\nextent_writepage() loop, we also risk csum violations for those
\nsubmissions. Zoned writes are clamped to max_zone_append_size and are
\nnot aligned with folios, so a submission can span two folios. The first
\nfolio being processed in extent_write_cache_pages() will call
\nextent_write_locked_range() which will submit the partial range of the
\nnext folio, while the rest of that folio could still be dirty. So
\nclearing dirty on the submitted sectors doesn’t call
\nfolio_clear_dirty_for_io() and we have the same issue. Since
\nextent_write_cache_pages() skips these batch submitted folios (they are
\nalready marked for writeback from submission by the preceding folio), we
\nmust add the extra write protection in lock_delalloc_folios().<\/p>\n
3. For inline extents this will subtly risk losing writes that happen
\nafter\/while we copy the inline extent but before we clear dirty on
\nthe folio.<\/p>\n
4. For folios spanning EOF, mmap could tamper with the zeroed bytes past
\nEOF and cause them to be persisted where future faults would improperly
\nsee them instead of zeros.<\/p>\n
5. Finally, for compressed extents, we risk modifying the folios while we
\nwork on compressing them which will result in corrupted compressed data.
\nSpecifically, in run_delalloc_compressed() we queue up work to do
\ncompress_file_range() in BTRFS_COMPRESSION_CHUNK_SIZE (512K) chunks which
\nwill call btrfs_folio_clamp_clear_dirty() on the range. For non-subpage,
\nthis will always clear the whole folio, safely. For subpage, we risk a
\npartial clear here as well. In particular, imagine a 2M folio broken up
\ninto 512K chunks of work which might start compression work on one chunk
\nbefore all the chunks compress_file_range() workers have gotten far
\nenough to finish clearing all the dirty bitmaps of the folio and getting
\nto folio_clear_dirty_for_io(). Large folios on the edges of submission
\nranges are similarly at risk to be only partly cleared.
\nThis particular gap was introduced by a second patch in the same series:
\ncommit a4ef54dbb576 (“btrfs: make extent_range_clear_dirty_for_io() to handle sector size < page size cases")<\/p>\n
We cannot simply restore the call to folio_clear
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: write-protect folios during data writeback<\/p>\n
commit 095be159f3eb (“btrfs: unify folio dirty flag clearing”) replaced
\nthe foli<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21694","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21694","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21694"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21694"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21694"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}