CVE-2023-53608

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential UAF of struct nilfsscinfo in nilfssegctorthread()

The finalization of nilfssegctorthread() can race with nilfssegctorkill_thread() which terminates that thread, potentially causing a use-after-free BUG as KASAN detected.

At the end of nilfssegctorthread(), it assigns NULL to "sctask" member of "struct nilfsscinfo" to indicate the thread has finished, and then notifies nilfssegctorkillthread() of this using waitqueue "scwaittask" on the struct nilfsscinfo.

However, here, immediately after the NULL assignment to "sctask", it is possible that nilfssegctorkillthread() will detect it and return to continue the deallocation, freeing the nilfsscinfo structure before the thread does the notification.

This fixes the issue by protecting the NULL assignment to "sctask" and its notification, with spinlock "scstatelock" of the struct nilfsscinfo. Since nilfssegctorkillthread() does a final check to see if "sctask" is NULL with "scstate_lock" locked, this can eliminate the race.