TLDRVuln - Cybersecurity Vulnerabilities Made Simple

In the Linux kernel, the following vulnerability has been resolved:

ext4: publish jinode after initialization

ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.

It used to set ei->jinode before jbd2_journal_init_jbd_inode(),

allowing a reader to observe a non-NULL jinode with i_vfs_inode

still unset.

The fast commit flush path can then pass this jinode to

jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and

may crash.

Below is the crash I observe:

```

BUG: unable to handle page fault for address: 000000010beb47f4

PGD 110e51067 P4D 110e51067 PUD 0

Oops: Oops: 0000 [#1] SMP NOPTI

CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014

RIP: 0010:xas_find_marked+0x3d/0x2e0

Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02

RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246

RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003

RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10

RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec

R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000

R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88

FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0

PKRU: 55555554

Call Trace:

<TASK>

filemap_get_folios_tag+0x87/0x2a0

__filemap_fdatawait_range+0x5f/0xd0