CVE-2024-50229

nilfs2: fix potential deadlock with newly created symlinks

Medium · published November 9, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential deadlock with newly created symlinks

Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers

memory reclamation involving the filesystem layer, which can result in

circular lock dependencies among the reader/writer semaphore

nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the

fs_reclaim pseudo lock.

This is because after commit 21fc61c73c39 ("don't put symlink bodies in

pagecache into highmem"), the gfp flags of the page cache for symbolic

links are overwritten to GFP_KERNEL via inode_nohighmem().

This is not a problem for symlinks read from the backing device, because

the __GFP_FS flag is dropped after inode_nohighmem() is called. However,

when a new symlink is created with nilfs_symlink(), the gfp flags remain

overwritten to GFP_KERNEL. Then, memory allocation called from

page_symlink() etc. triggers memory reclamation including the FS layer,

which may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can

cause a deadlock if they are called while nilfs->ns_segctor_sem is held:

Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags

of newly created symlinks in the same way that nilfs_new_inode() and

__nilfs_read_inode() do, as a workaround until we adopt nofs allocation

scope consistently or improve the locking constraints.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.2th percentile
Published
2024-11-09T10:14Z
EPSS history
Timeline
  • 09 NOV 10:14Z
    nilfs2: fix potential deadlock with newly created symlinks
    cvelistv5