In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix inode number range checks
Patch series "nilfs2: fix potential issues related to reserved inodes".
This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's internal inode being exposed in the namespace on a corrupted filesystem, and a couple of flaws that cause problems if the starting number of non-reserved inodes written in the on-disk super block is intentionally (or corruptly) changed from its default value.
This patch (of 3):
In the current implementation of nilfs2, "nilfs->nsfirstino", which gives the first non-reserved inode number, is read from the superblock, but its lower limit is not checked.
As a result, if a number that overlaps with the inode number range of reserved inodes such as the root directory or metadata files is set in the super block parameter, the inode number test macros (NILFSMDTINODE and NILFSVALIDINODE) will not function properly.
In addition, these test macros use left bit-shift calculations using with the inode number as the shift count via the BIT macro, but the result of a shift calculation that exceeds the bit width of an integer is undefined in the C specification, so if "nsfirstino" is set to a large value other than the default value NILFSUSERINO (=11), the macros may potentially malfunction depending on the environment.
Fix these issues by checking the lower bound of "nilfs->nsfirstino" and by preventing bit shifts equal to or greater than the NILFSUSERINO constant in the inode number test macros.
Also, change the type of "nsfirstino" from signed integer to unsigned integer to avoid the need for type casting in comparisons such as the lower bound check introduced this time.
[
{
"digest": {
"length": 2266.0,
"function_hash": "21227249864376129290509475596300594842"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9194f8ca57527958bee207919458e372d638d783",
"id": "CVE-2024-42105-06cc93e5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fec219a36e0993642844be0f345513507031f4",
"id": "CVE-2024-42105-0be582d0"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08cab183a624ba71603f3754643ae11cab34dbc4",
"id": "CVE-2024-42105-22b7ff0d"
},
{
"digest": {
"length": 2358.0,
"function_hash": "310378420307078210793604953512164344147"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08cab183a624ba71603f3754643ae11cab34dbc4",
"id": "CVE-2024-42105-26512e53"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fec219a36e0993642844be0f345513507031f4",
"id": "CVE-2024-42105-2c505e6e"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731011ac6c37cbe97ece229fc6daa486276052c5",
"id": "CVE-2024-42105-3264227e"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987",
"id": "CVE-2024-42105-3b5b4bc4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57235c3c88bb430043728d0d02f44a4efe386476",
"id": "CVE-2024-42105-3cd588d6"
},
{
"digest": {
"length": 2336.0,
"function_hash": "332412596788772319936638822477724037476"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987",
"id": "CVE-2024-42105-3ce42b51"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57235c3c88bb430043728d0d02f44a4efe386476",
"id": "CVE-2024-42105-5a8f0e5f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fae1959d6ab2c52677b113935e36ab4e25df37ea",
"id": "CVE-2024-42105-66a9f512"
},
{
"digest": {
"length": 2266.0,
"function_hash": "21227249864376129290509475596300594842"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fec219a36e0993642844be0f345513507031f4",
"id": "CVE-2024-42105-7823bb21"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57235c3c88bb430043728d0d02f44a4efe386476",
"id": "CVE-2024-42105-805067ab"
},
{
"digest": {
"length": 2336.0,
"function_hash": "332412596788772319936638822477724037476"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731011ac6c37cbe97ece229fc6daa486276052c5",
"id": "CVE-2024-42105-85475970"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08cab183a624ba71603f3754643ae11cab34dbc4",
"id": "CVE-2024-42105-88bf3709"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9194f8ca57527958bee207919458e372d638d783",
"id": "CVE-2024-42105-9c69e2c6"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c91058425a01131ea30dda6cf43c67b17884d6a",
"id": "CVE-2024-42105-a3827ec0"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987",
"id": "CVE-2024-42105-a41de724"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731011ac6c37cbe97ece229fc6daa486276052c5",
"id": "CVE-2024-42105-ac692b40"
},
{
"digest": {
"length": 2266.0,
"function_hash": "21227249864376129290509475596300594842"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fae1959d6ab2c52677b113935e36ab4e25df37ea",
"id": "CVE-2024-42105-b1d05699"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c91058425a01131ea30dda6cf43c67b17884d6a",
"id": "CVE-2024-42105-b412c09a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987",
"id": "CVE-2024-42105-b494e314"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08cab183a624ba71603f3754643ae11cab34dbc4",
"id": "CVE-2024-42105-caf61df4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fae1959d6ab2c52677b113935e36ab4e25df37ea",
"id": "CVE-2024-42105-d26a4b3e"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9194f8ca57527958bee207919458e372d638d783",
"id": "CVE-2024-42105-d504c6ea"
},
{
"digest": {
"length": 2266.0,
"function_hash": "21227249864376129290509475596300594842"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c91058425a01131ea30dda6cf43c67b17884d6a",
"id": "CVE-2024-42105-d76cd881"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fec219a36e0993642844be0f345513507031f4",
"id": "CVE-2024-42105-dbaa3325"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"153093855192478051304877828335158637529",
"315366500066516076640503347574144982371",
"98318676887176886814566684464390969943",
"229367007203164648930956616469043113224",
"241687571817399489568559162676765956649"
]
},
"target": {
"file": "fs/nilfs2/nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9194f8ca57527958bee207919458e372d638d783",
"id": "CVE-2024-42105-e4c680fe"
},
{
"digest": {
"length": 2358.0,
"function_hash": "310378420307078210793604953512164344147"
},
"target": {
"function": "nilfs_store_disk_layout",
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57235c3c88bb430043728d0d02f44a4efe386476",
"id": "CVE-2024-42105-f50bb336"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fae1959d6ab2c52677b113935e36ab4e25df37ea",
"id": "CVE-2024-42105-f6fe9a56"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19109981419263405377428612077165275476",
"322481424776556187835380825081885312405",
"237670509399483249046960178733806542791",
"180122956015128596683110821865139201952"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@731011ac6c37cbe97ece229fc6daa486276052c5",
"id": "CVE-2024-42105-fc694272"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163748396240930196382680051282618826183",
"274813770452573722395371180689845634106",
"99800954484933505196783228491436634927",
"44818439929860603189148344342849859314"
]
},
"target": {
"file": "fs/nilfs2/the_nilfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c91058425a01131ea30dda6cf43c67b17884d6a",
"id": "CVE-2024-42105-fded3f63"
}
]