CVE-2024-27036

cifs: Fix writeback data corruption

published May 1, 2024

CVSS
—
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix writeback data corruption

cifs writeback doesn't correctly handle the case where

cifs_extend_writeback() hits a point where it is considering an additional

folio, but this would overrun the wsize - at which point it drops out of

the xarray scanning loop and calls xas_pause(). The problem is that

xas_pause() advances the loop counter - thereby skipping that page.

What needs to happen is for xas_reset() to be called any time we decide we

don't want to process the page we're looking at, but rather send the

request we are building and start a new one.

Fix this by copying and adapting the netfslib writepages code as a

temporary measure, with cifs writeback intending to be offloaded to

netfslib in the near future.

This also fixes the issue with the use of filemap_get_folios_tag() causing

retry of a bunch of pages which the extender already dealt with.

This can be tested by creating, say, a 64K file somewhere not on cifs

(otherwise copy-offload may get underfoot), mounting a cifs share with a

wsize of 64000, copying the file to it and then comparing the original file

and the copy:

dd if=/dev/urandom of=/tmp/64K bs=64k count=1

mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000

cp /tmp/64K /mnt/64K

cmp /tmp/64K /mnt/64K

Without the fix, the cmp fails at position 64000 (or shortly thereafter).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.7th percentile
Published
2024-05-01T12:53Z
EPSS history
Timeline
  • 01 MAY 12:53Z
    cifs: Fix writeback data corruption
    cvelistv5