In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iomap: guard io_size EOF trim against concurrent truncate underflow<\/p>\n
iomap: fix zero padding data issue in concurrent append writes
\nchanged ioend accounting so that io_size tracks only valid data
\nwithin EOF. This trims io_size when a writeback range extends
\npast end_pos:<\/p>\n
ioend->io_size += map_len;
\n if (ioend->io_offset + ioend->io_size > end_pos)
\n ioend->io_size = end_pos – ioend->io_offset;<\/p>\n
However, if end_pos ends up below ioend->io_offset, the subtraction
\nbecomes negative and is stored in size_t io_size, causing an unsigned
\nwrap to a huge value. This can happen when writeback continues past
\nbyte-level EOF up to a block-aligned range, or when a concurrent
\ntruncate shrinks the file after end_pos was sampled in
\niomap_writeback_handle_eof().<\/p>\n
A wrapped io_size can mislead append detection and corrupt
\ncompletion-time size handling, since filesystem end_io paths consume
\nio_size for decisions such as on-disk EOF updates and unwritten\/COW
\ncompletion ranges.<\/p>\n
Fix this by clamping io_size to zero when EOF has moved to or before
\nthe ioend start offset. This preserves the original intent of trimming
\nio_size to valid in-EOF data while avoiding the underflow.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iomap: guard io_size EOF trim against concurrent truncate underflow<\/p>\n
iomap: fix zero padding data issue in concurrent append writes<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7005","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}