In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs: don’t return -EINVAL for successful nested thaw<\/p>\n
Commit 7366f8b6fc6a (“fs: handle freezing from multiple devices”)
\nreplaced the freeze_holders bitmask with per-holder counters to allow
\nnested freezes. In the bitmask version, a thaw that released a shared
\nhold while another holder remained returned 0. Since the rework,
\nthaw_super_locked() drops the freeze reference via freeze_dec() but
\nthen returns -EINVAL when other freezers remain, misinforming the
\ncaller: the thaw did succeed, the superblock just stays frozen for the
\nremaining holders.<\/p>\n
This breaks bdev-initiated freezing. When a filesystem is frozen with
\nFIFREEZE and additionally frozen via bdev_freeze() — which nests by
\ndesign, see fs_bdev_freeze() — the subsequent bdev_thaw() receives
\n-EINVAL from the holder op although its freeze reference was dropped,
\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper’s
\nunlock_fs() ignores bdev_thaw()’s return value, so nothing rebalances
\nthe count. After the user’s FITHAW and umount, the block device can
\nnever be mounted again:<\/p>\n
dm-1: Can’t mount, blockdev is frozen<\/p>\n
There is no way for userspace to drop the leaked count; only
\ndestroying the block device (or a reboot) recovers the device.<\/p>\n
Reproducer (any kernel since v6.8):<\/p>\n
dmsetup create dut –table “0 $(blockdev –getsz “$DEV”) linear $DEV 0″
\n mkfs.ext4 \/dev\/mapper\/dut
\n mount \/dev\/mapper\/dut \/mnt
\n fsfreeze –freeze \/mnt # freeze_ucount == 1
\n dmsetup suspend dut # bd_fsfreeze_count == 1, ucount == 2
\n dmsetup resume dut # ucount 2 -> 1, but thaw_super()
\n # returns -EINVAL, so bdev_thaw()
\n # keeps bd_fsfreeze_count at 1
\n fsfreeze –unfreeze \/mnt # filesystem thaws fine
\n umount \/mnt
\n mount \/dev\/mapper\/dut \/mnt # EBUSY, forever<\/p>\n
The same happens with fsfreeze held across an LVM snapshot of the
\norigin volume.<\/p>\n
fs_bdev_thaw()’s documentation already describes the intended
\nsemantics: “If this function returns zero it doesn’t mean that the
\nfilesystem is unfrozen as it may have been frozen multiple times”.
\nRestore them by returning 0 when a nested thaw drops its hold while
\nother freezers remain. Thawing without holding a freeze still fails
\nwith -EINVAL as may_unfreeze() rejects that case before the reference
\ncount is touched.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs: don’t return -EINVAL for successful nested thaw<\/p>\n
Commit 7366f8b6fc6a (“fs: handle freezing from multiple devices”)
\nreplaced the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29058","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}