| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49706: zonefs: fix zonefs_iomap_begin() for reads |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| zonefs: fix zonefs_iomap_begin() for reads |
| |
| If a readahead is issued to a sequential zone file with an offset |
| exactly equal to the current file size, the iomap type is set to |
| IOMAP_UNWRITTEN, which will prevent an IO, but the iomap length is |
| calculated as 0. This causes a WARN_ON() in iomap_iter(): |
| |
| [17309.548939] WARNING: CPU: 3 PID: 2137 at fs/iomap/iter.c:34 iomap_iter+0x9cf/0xe80 |
| [...] |
| [17309.650907] RIP: 0010:iomap_iter+0x9cf/0xe80 |
| [...] |
| [17309.754560] Call Trace: |
| [17309.757078] <TASK> |
| [17309.759240] ? lock_is_held_type+0xd8/0x130 |
| [17309.763531] iomap_readahead+0x1a8/0x870 |
| [17309.767550] ? iomap_read_folio+0x4c0/0x4c0 |
| [17309.771817] ? lockdep_hardirqs_on_prepare+0x400/0x400 |
| [17309.778848] ? lock_release+0x370/0x750 |
| [17309.784462] ? folio_add_lru+0x217/0x3f0 |
| [17309.790220] ? reacquire_held_locks+0x4e0/0x4e0 |
| [17309.796543] read_pages+0x17d/0xb60 |
| [17309.801854] ? folio_add_lru+0x238/0x3f0 |
| [17309.807573] ? readahead_expand+0x5f0/0x5f0 |
| [17309.813554] ? policy_node+0xb5/0x140 |
| [17309.819018] page_cache_ra_unbounded+0x27d/0x450 |
| [17309.825439] filemap_get_pages+0x500/0x1450 |
| [17309.831444] ? filemap_add_folio+0x140/0x140 |
| [17309.837519] ? lock_is_held_type+0xd8/0x130 |
| [17309.843509] filemap_read+0x28c/0x9f0 |
| [17309.848953] ? zonefs_file_read_iter+0x1ea/0x4d0 [zonefs] |
| [17309.856162] ? trace_contention_end+0xd6/0x130 |
| [17309.862416] ? __mutex_lock+0x221/0x1480 |
| [17309.868151] ? zonefs_file_read_iter+0x166/0x4d0 [zonefs] |
| [17309.875364] ? filemap_get_pages+0x1450/0x1450 |
| [17309.881647] ? __mutex_unlock_slowpath+0x15e/0x620 |
| [17309.888248] ? wait_for_completion_io_timeout+0x20/0x20 |
| [17309.895231] ? lock_is_held_type+0xd8/0x130 |
| [17309.901115] ? lock_is_held_type+0xd8/0x130 |
| [17309.906934] zonefs_file_read_iter+0x356/0x4d0 [zonefs] |
| [17309.913750] new_sync_read+0x2d8/0x520 |
| [17309.919035] ? __x64_sys_lseek+0x1d0/0x1d0 |
| |
| Furthermore, this causes iomap_readahead() to loop forever as |
| iomap_readahead_iter() always returns 0, making no progress. |
| |
| Fix this by treating reads after the file size as access to holes, |
| setting the iomap type to IOMAP_HOLE, the iomap addr to IOMAP_NULL_ADDR |
| and using the length argument as is for the iomap length. To simplify |
| the code with this change, zonefs_iomap_begin() is split into the read |
| variant, zonefs_read_iomap_begin() and zonefs_read_iomap_ops, and the |
| write variant, zonefs_write_iomap_begin() and zonefs_write_iomap_ops. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49706 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.6 with commit 8dcc1a9d90c10fa4143e5c17821082e5e60e46a1 and fixed in 5.10.125 with commit 355be6131164c5bacf2e810763835aecb6e01fcb |
| Issue introduced in 5.6 with commit 8dcc1a9d90c10fa4143e5c17821082e5e60e46a1 and fixed in 5.15.50 with commit c2f71b9bb398e2e573bdc2574149f42b45efe410 |
| Issue introduced in 5.6 with commit 8dcc1a9d90c10fa4143e5c17821082e5e60e46a1 and fixed in 5.18.7 with commit 3a7f05f104347b407e865c10be2675cd833a4e48 |
| Issue introduced in 5.6 with commit 8dcc1a9d90c10fa4143e5c17821082e5e60e46a1 and fixed in 5.19 with commit c1c1204c0d0c1dccc1310b9277fb2bd8b663d8fe |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49706 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/zonefs/super.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/355be6131164c5bacf2e810763835aecb6e01fcb |
| https://git.kernel.org/stable/c/c2f71b9bb398e2e573bdc2574149f42b45efe410 |
| https://git.kernel.org/stable/c/3a7f05f104347b407e865c10be2675cd833a4e48 |
| https://git.kernel.org/stable/c/c1c1204c0d0c1dccc1310b9277fb2bd8b663d8fe |
