| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47460: ocfs2: fix data corruption after conversion from inline format |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ocfs2: fix data corruption after conversion from inline format |
| |
| Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in |
| block_write_full_page()") uncovered a latent bug in ocfs2 conversion |
| from inline inode format to a normal inode format. |
| |
| The code in ocfs2_convert_inline_data_to_extents() attempts to zero out |
| the whole cluster allocated for file data by grabbing, zeroing, and |
| dirtying all pages covering this cluster. However these pages are |
| beyond i_size, thus writeback code generally ignores these dirty pages |
| and no blocks were ever actually zeroed on the disk. |
| |
| This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero |
| pages past i_size.") for standard ocfs2 write path, inline conversion |
| path was apparently forgotten; the commit log also has a reasoning why |
| the zeroing actually is not needed. |
| |
| After commit 6dbf7bb55598, things became worse as writeback code stopped |
| invalidating buffers on pages beyond i_size and thus these pages end up |
| with clean PageDirty bit but with buffers attached to these pages being |
| still dirty. So when a file is converted from inline format, then |
| writeback triggers, and then the file is grown so that these pages |
| become valid, the invalid dirtiness state is preserved, |
| mark_buffer_dirty() does nothing on these pages (buffers are already |
| dirty) but page is never written back because it is clean. So data |
| written to these pages is lost once pages are reclaimed. |
| |
| Simple reproducer for the problem is: |
| |
| xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \ |
| -c "pwrite 4000 2000" ocfs2_file |
| |
| After unmounting and mounting the fs again, you can observe that end of |
| 'ocfs2_file' has lost its contents. |
| |
| Fix the problem by not doing the pointless zeroing during conversion |
| from inline format similarly as in the standard write path. |
| |
| [akpm@linux-foundation.org: fix whitespace, per Joseph] |
| |
| The Linux kernel CVE team has assigned CVE-2021-47460 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.9.242 with commit acef5107e2eacb08a16ad5db60320d65bd26a6c0 and fixed in 4.9.288 with commit 560edd14de2bf9dbc0129681eeb4d5ef87cc105f |
| Issue introduced in 4.14.204 with commit 7ed80e77c908cbaa686529a49f8ae0060c5caee7 and fixed in 4.14.253 with commit 8e6bfb4f70168ddfd32fb6dc028ad52faaf1f32e |
| Issue introduced in 4.19.155 with commit 7ce2b16bad2cbfa3fa7bbc42c4448914f639ca47 and fixed in 4.19.214 with commit a3a089c241cd49b33a8cdd7fcb37cc87a086912a |
| Issue introduced in 5.4.75 with commit f8a6a2ed4b7d1c3c8631eeb6d00572bc853094a8 and fixed in 5.4.156 with commit b05caf023b14cbed9223bb5b48ecc7bffe38f632 |
| Issue introduced in 5.10 with commit 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b and fixed in 5.10.76 with commit f1b98569e81c37d7e0deada7172f8f60860c1360 |
| Issue introduced in 5.10 with commit 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b and fixed in 5.14.15 with commit fa9b6b6c953e3f6441ed6cf83b4c771dac2dae08 |
| Issue introduced in 5.10 with commit 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b and fixed in 5.15 with commit 5314454ea3ff6fc746eaf71b9a7ceebed52888fa |
| Issue introduced in 5.9.5 with commit 36ed9e604215f58cec0381ca5fcc6da05f2d87ca |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47460 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ocfs2/alloc.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/560edd14de2bf9dbc0129681eeb4d5ef87cc105f |
| https://git.kernel.org/stable/c/8e6bfb4f70168ddfd32fb6dc028ad52faaf1f32e |
| https://git.kernel.org/stable/c/a3a089c241cd49b33a8cdd7fcb37cc87a086912a |
| https://git.kernel.org/stable/c/b05caf023b14cbed9223bb5b48ecc7bffe38f632 |
| https://git.kernel.org/stable/c/f1b98569e81c37d7e0deada7172f8f60860c1360 |
| https://git.kernel.org/stable/c/fa9b6b6c953e3f6441ed6cf83b4c771dac2dae08 |
| https://git.kernel.org/stable/c/5314454ea3ff6fc746eaf71b9a7ceebed52888fa |
