In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->bfrozendata == NULL' failure when journal aborted
Following process will fail assertion 'jh->bfrozendata == NULL' in jbd2journaldirty_metadata():
jbd2_journal_commit_transaction
unlink(dir/a) jh->btransaction = trans1 jh->bjlist = BJMetadata journal->jrunningtransaction = NULL trans1->tstate = TCOMMIT unlink(dir/b) handle->htrans = trans2 dogetwriteaccess jh->bmodified = 0 jh->bfrozendata = frozenbuffer jh->bnexttransaction = trans2 jbd2journaldirtymetadata ishandleaborted isjournalaborted // return false
--> jbd2 abort <--
while (commit_transaction->t_buffers)
if (is_journal_aborted)
jbd2_journal_refile_buffer
__jbd2_journal_refile_buffer
WRITE_ONCE(jh->b_transaction,
jh->b_next_transaction)
WRITE_ONCE(jh->b_next_transaction, NULL)
__jbd2_journal_file_buffer(jh, BJ_Reserved)
J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !
The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2journaldirtymetadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> _ext4handledirtymetadata+0xa0/0x290 ext4handledirtydirblock+0x10c/0x1d0 ext4deleteentry+0x104/0x200 _ext4unlink+0x22b/0x360 ext4unlink+0x275/0x390 vfsunlink+0x20b/0x4c0 dounlinkat+0x42f/0x4c0 _x64sysunlink+0x37/0x50 dosyscall64+0x35/0x80
After journal aborting, _jbd2journalrefilebuffer() is executed with holding @jh->bstatelock, we can fix it by moving 'ishandleaborted()' into the area protected by @jh->bstatelock.
{ "vanir_signatures": [ { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-119177fe", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "315811726425503571356493540379120092494", "259591474267196384239603882022713326715", "6854678228661244276736063457045566383" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731c1662d838fe954c6759e3ee43229b0d928fe4" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-1568197a", "digest": { "length": 2941.0, "function_hash": "162784226152161884494588075965568268599" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-31218dc6", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "160140178699827562711674660421716512738", "278782126079991261481761917517714108567", "211044414789607329880812101205302426213" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6073389db83b903678a0920554fa19f5bdc51c48" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-3c684cac", "digest": { "length": 3068.0, "function_hash": "279146262570805675029830085080938673501" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7161d0da975adc234161cd0641d0e484f5ce375" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-4ab562d4", "digest": { "length": 3068.0, "function_hash": "279146262570805675029830085080938673501" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a734f0869f970b8a9b65062ea40b09a5da9dba8" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-6bcae64c", "digest": { "length": 3068.0, "function_hash": "279146262570805675029830085080938673501" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd896792e1718cb84c96f3e618270589b6886dc" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-6ecf56f5", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "160140178699827562711674660421716512738", "278782126079991261481761917517714108567", "211044414789607329880812101205302426213" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-7c90469c", "digest": { "length": 2941.0, "function_hash": "162784226152161884494588075965568268599" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa5b65d39332fef7a11ae99cb1f0696012a61527" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-88eaf6cf", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "160140178699827562711674660421716512738", "278782126079991261481761917517714108567", "211044414789607329880812101205302426213" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa5b65d39332fef7a11ae99cb1f0696012a61527" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-94f7d731", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "315811726425503571356493540379120092494", "259591474267196384239603882022713326715", "6854678228661244276736063457045566383" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f79827784f56499a50ea2e893c98317b5407b" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-ab415813", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "315811726425503571356493540379120092494", "259591474267196384239603882022713326715", "6854678228661244276736063457045566383" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd896792e1718cb84c96f3e618270589b6886dc" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-b0200e59", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "315811726425503571356493540379120092494", "259591474267196384239603882022713326715", "6854678228661244276736063457045566383" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a734f0869f970b8a9b65062ea40b09a5da9dba8" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-b52315f5", "digest": { "length": 3068.0, "function_hash": "279146262570805675029830085080938673501" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f79827784f56499a50ea2e893c98317b5407b" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-c81e8e4f", "digest": { "length": 3068.0, "function_hash": "279146262570805675029830085080938673501" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731c1662d838fe954c6759e3ee43229b0d928fe4" }, { "target": { "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-ddf9999f", "digest": { "threshold": 0.9, "line_hashes": [ "57261870647445734509925683889240485465", "62204868143713157967903975665046504338", "340112707812113244580089339242746252661", "311836933658224442329000839890356960086", "224119567858552312418137184582624086512", "315811726425503571356493540379120092494", "259591474267196384239603882022713326715", "6854678228661244276736063457045566383" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7161d0da975adc234161cd0641d0e484f5ce375" }, { "target": { "function": "jbd2_journal_dirty_metadata", "file": "fs/jbd2/transaction.c" }, "deprecated": false, "id": "CVE-2022-50126-e51baf04", "digest": { "length": 2941.0, "function_hash": "162784226152161884494588075965568268599" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6073389db83b903678a0920554fa19f5bdc51c48" } ] }