CVE-2025-21643

netfs: Fix kernel async DIO

published January 19, 2025

CVSS
—
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix kernel async DIO

Netfslib needs to be able to handle kernel-initiated asynchronous DIO that

is supplied with a bio_vec[] array. Currently, because of the async flag,

this gets passed to netfs_extract_user_iter() which throws a warning and

fails because it only handles IOVEC and UBUF iterators. This can be

triggered through a combination of cifs and a loopback blockdev with

something like:

mount //my/cifs/share /foo

dd if=/dev/zero of=/foo/m0 bs=4K count=1K

losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0

echo hello >/dev/loop2046

This causes the following to appear in syslog:

WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]

and the write to fail.

Fix this by removing the check in netfs_unbuffered_write_iter_locked() that

causes async kernel DIO writes to be handled as userspace writes. Note

that this change relies on the kernel caller maintaining the existence of

the bio_vec array (or kvec[] or folio_queue) until the op is complete.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.2th percentile
Published
2025-01-19T10:17Z
EPSS history
Timeline
  • 19 JAN 10:17Z
    netfs: Fix kernel async DIO
    cvelistv5