In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix null-ptr-deref in blocktouchbuffer tracepoint
Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".
This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.
This patch (of 2):
It has been reported that when using "block:blocktouchbuffer" tracepoint, touchbuffer() called from _nilfsgetfolio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.
This happens because since the tracepoint was added in touchbuffer(), it references the devt member bh->bbdev->bddev regardless of whether the buffer head has a pointer to a blockdevice structure. In the current implementation, the blockdevice structure is set after the function returns to the caller.
Here, touchbuffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touchbuffer() here in the first place.
So this solves the issue by eliminating the touch_buffer() call itself.
[
{
"signature_version": "v1",
"id": "CVE-2024-53131-11758dbe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@085556bf8c70e2629e02e79268dac3016a08b8bf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-36fd2db2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19c71cdd77973f99a9adc3190130bc3aa7ae5423",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-4c7d6965",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b49ca67cca7b007a5afd3de0283c8008157665",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-4ed2e9f5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b2a4fd9bbee77afdd3ed5a05a0c02b6cde8d3b9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-4f08c23f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96246397875403911094619096352152741080",
"37369214103365313530064331642588525557",
"255978887731092984980866253633867541324",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-53cfb05d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77e47f89d32c2d72eb33d0becbce7abe14d061f4",
"digest": {
"length": 385.0,
"function_hash": "70255492968016980519129774555981037677"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_folio_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-53f7f218",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b017697a517f8779ada4e8ce1c2c75dbf60a2636",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-54d394ab",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6438f3f42cda825f6f59b4e45ac3a1da28a6f2c9",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-6e509998",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b017697a517f8779ada4e8ce1c2c75dbf60a2636",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-7a713e35",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b49ca67cca7b007a5afd3de0283c8008157665",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-91addb0d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77e47f89d32c2d72eb33d0becbce7abe14d061f4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96246397875403911094619096352152741080",
"37369214103365313530064331642588525557",
"255978887731092984980866253633867541324",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-c6e17935",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b2a4fd9bbee77afdd3ed5a05a0c02b6cde8d3b9",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-c7102959",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471",
"digest": {
"length": 385.0,
"function_hash": "70255492968016980519129774555981037677"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_folio_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-c785a85d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6438f3f42cda825f6f59b4e45ac3a1da28a6f2c9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28886446042025421219679182870533525567",
"43908477632109595521563175224890774263",
"164238957312438256461297980274152681447",
"23694240432253475178001856340025105278"
]
},
"deprecated": false,
"target": {
"file": "fs/nilfs2/page.c"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-eacc4ec9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@085556bf8c70e2629e02e79268dac3016a08b8bf",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2024-53131-fb8490d0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19c71cdd77973f99a9adc3190130bc3aa7ae5423",
"digest": {
"length": 375.0,
"function_hash": "269737434929868964984092038562846620339"
},
"deprecated": false,
"target": {
"function": "__nilfs_get_page_block",
"file": "fs/nilfs2/page.c"
},
"signature_type": "Function"
}
]