CVE-2024-47669

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix state management in error path of log writing function

After commit a694291a6211 ("nilfs2: separate wait function from

nilfs_segctor_write") was applied, the log writing function

nilfs_segctor_do_construct() was able to issue I/O requests continuously

even if user data blocks were split into multiple logs across segments,

but two potential flaws were introduced in its error handling.

First, if nilfs_segctor_begin_construction() fails while creating the

second or subsequent logs, the log writing function returns without

calling nilfs_segctor_abort_construction(), so the writeback flag set on

pages/folios will remain uncleared. This causes page cache operations to

hang waiting for the writeback flag. For example,

truncate_inode_pages_final(), which is called via nilfs_evict_inode() when

an inode is evicted from memory, will hang.

Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared.

As a result, if the next log write involves checkpoint creation, that's

fine, but if a partial log write is performed that does not, inodes with

NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files"

list, and their data and b-tree blocks may not be written to the device,

corrupting the block mapping.

Fix these issues by uniformly calling nilfs_segctor_abort_construction()

on failure of each step in the loop in nilfs_segctor_do_construct(),

having it clean up logs and segment usages according to progress, and

correcting the conditions for calling nilfs_redirty_inodes() to ensure

that the NILFS_I_COLLECTED flag is cleared.