In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential bug in endbufferasync_write
According to a syzbot report, endbufferasyncwrite(), which handles the completion of block device writes, may detect abnormal condition of the buffer asyncwrite flag and cause a BUG_ON failure when using nilfs2.
Nilfs2 itself does not use endbufferasyncwrite(). But, the asyncwrite flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfslookupdirtydatabuffers() and nilfslookupnode_buffers() and the resulting crash.
This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce asyncwrite for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUGON check in endbufferasync_write would fail as described above, if independent writebacks of the backing device occurred in parallel.
The use of async_write for segment summary buffers has already been removed in a previous change.
Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer.
[
{
"digest": {
"function_hash": "163043834926589319296507995295213055374",
"length": 862.0
},
"id": "CVE-2024-26685-011920f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bc09b397cbf1221f8a8aacb1152650c9195b02b",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-027fcbd8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6589f0f72f8edd1fa11adce4eedbd3615f2e78ab",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-0388c8ca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6589f0f72f8edd1fa11adce4eedbd3615f2e78ab",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"286629315169641466988818079338762729285",
"172969768854888702474089408646276750996",
"116906124376377703650547634388763305343",
"135109995187517867195697277489485029878",
"236821701467428439488099412256544503021",
"135292797467303673444053586767962137162",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"284904882509245000227213297187156275942",
"116906124376377703650547634388763305343",
"135109995187517867195697277489485029878",
"317974869216961699429177862854929410555",
"100325969148655347458298818660003884266",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"35757543920974171218985568870280592236",
"23296310204636025891040748821744182153",
"2538724665991109134878578074204586667",
"312517159510007121969574202848893273904",
"125362219864690796678069746448218728722",
"153732249272975521849062571133187778826",
"240237683100621060086899357951193113033"
]
},
"id": "CVE-2024-26685-0b247a8f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bc09b397cbf1221f8a8aacb1152650c9195b02b",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "240080187040815115331730548679885065394",
"length": 770.0
},
"id": "CVE-2024-26685-0c31e782",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bc09b397cbf1221f8a8aacb1152650c9195b02b",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-1bccb540",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3bdba00283a6c7a5b19481a59a730f46063803",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-1e85217a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@626daab3811b772086aef1bf8eed3ffe6f523eff",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-24102f70",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fa90634ec3e9cc50f42dd605eec60f2d146ced8",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-25cc1a34",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3bdba00283a6c7a5b19481a59a730f46063803",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-36efd2c6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6589f0f72f8edd1fa11adce4eedbd3615f2e78ab",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-3a6e3e2b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4a09fdac625e64abe478dcf88bfa20406616928",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-3c7888da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@626daab3811b772086aef1bf8eed3ffe6f523eff",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-403f007c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e4963566f58726d3265a727116a42b591f6596",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-5c3e7db1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e4963566f58726d3265a727116a42b591f6596",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-6e00b667",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e4963566f58726d3265a727116a42b591f6596",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-74efa82a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d31c8721e816eff5ca6573cc487754f357c093cd",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-85060ef1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@626daab3811b772086aef1bf8eed3ffe6f523eff",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-88d20d29",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4a09fdac625e64abe478dcf88bfa20406616928",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-9618f049",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d31c8721e816eff5ca6573cc487754f357c093cd",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "27722358126344838221769880761945274713",
"length": 1999.0
},
"id": "CVE-2024-26685-96930000",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bc09b397cbf1221f8a8aacb1152650c9195b02b",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-9cf84421",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e4963566f58726d3265a727116a42b591f6596",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-9f1bf332",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d31c8721e816eff5ca6573cc487754f357c093cd",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-a39aa1e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@626daab3811b772086aef1bf8eed3ffe6f523eff",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-a96d85ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3bdba00283a6c7a5b19481a59a730f46063803",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-ca2cb1d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4a09fdac625e64abe478dcf88bfa20406616928",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-cc0c334c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3bdba00283a6c7a5b19481a59a730f46063803",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "151470427567418421948744831195971456681",
"length": 764.0
},
"id": "CVE-2024-26685-d2758678",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4a09fdac625e64abe478dcf88bfa20406616928",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_abort_logs"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-e9c9f8ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fa90634ec3e9cc50f42dd605eec60f2d146ced8",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "136493752199282267313867070166916692283",
"length": 856.0
},
"id": "CVE-2024-26685-ec2190cf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6589f0f72f8edd1fa11adce4eedbd3615f2e78ab",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_prepare_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-ef771d68",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d31c8721e816eff5ca6573cc487754f357c093cd",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"function_hash": "217172928138821815300192586574360968314",
"length": 1993.0
},
"id": "CVE-2024-26685-f9f8506b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fa90634ec3e9cc50f42dd605eec60f2d146ced8",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_complete_write"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"185835242936412385677597000014475504538",
"62241449780043084244655231643521370670",
"161645638676152769056310965975277777076",
"49968187073748020185602677681976593148",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"302853200739102230303492447957384752863",
"91902304348745969175266958491867797558",
"121953430214405727181619548940501362345",
"283497057542258423001686732579978259627",
"308587851852382301435144399207034508731",
"27576240846018291693533398077290092707",
"280107656169799896279411881877737518927",
"88455090954997979062996074793125517603",
"51998875846585868906932503561600290596",
"172083423122307100311888715495557282637",
"221728030933504565140824738431226712731",
"197516503960323154711686426664089685630",
"327546236025136776227204679210094568357",
"136100092286112448617159638883818812997",
"237193455149531191147342379206880720812",
"312517159510007121969574202848893273904",
"297310283666755129058817246338235285238",
"71607108553933128542548542950688335924",
"62987322507065871451739982825166419360"
]
},
"id": "CVE-2024-26685-fbb0b39c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fa90634ec3e9cc50f42dd605eec60f2d146ced8",
"target": {
"file": "fs/nilfs2/segment.c"
},
"deprecated": false
}
]