CVE-2024-40943: ocfs2: fix races between hole punching and AIO+DIO
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix races between hole punching and AIO+DIO
After commit "ocfs2: return real error code in ocfs2diowrgetblock", fstests/generic/300 become from always failed to sometimes failed:
======================================================================== [ 473.293420 ] run fstests generic/300
[ 475.296983 ] JBD2: Ignoring recovery information on journal [ 475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode. [ 494.290998 ] OCFS2: ERROR (device dm-1): ocfs2changeextentflag: Owner 5668 has an extent at cpos 78723 which can no longer be found [ 494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 494.292018 ] OCFS2: File system is now read-only. [ 494.292224 ] (kworker/19:11,2628,19):ocfs2markextentwritten:5272 ERROR: status = -30 [ 494.292602 ] (kworker/19:11,2628,19):ocfs2dioendiowrite:2374 ERROR: status = -3 fio: iou error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072 =========================================================================
In blockdevdirectIO, ocfs2diowrgetblock is called to add unwritten extents to a list. extents are also inserted into extent tree in ocfs2writebeginnolock. Then another thread call fallocate to puch a hole at one of the unwritten extent. The extent at cpos was removed by ocfs2removeextent(). At end io worker thread, ocfs2searchextentlist found there is no such extent at the cpos.
T1 T2 T3 inode lock ... insert extents ... inode unlock ocfs2fallocate ocfs2changefilespace inode lock lock ipallocsem ocfs2removeinoderange inode ocfs2removebtreerange ocfs2removeextent ^---remove the extent at cpos 78723 ... unlock ipallocsem inode unlock ocfs2dioendio ocfs2dioendiowrite lock ipallocsem ocfs2markextentwritten ocfs2changeextentflag ocfs2searchextentlist ^---failed to find extent ... unlock ipallocsem
In most filesystems, fallocate is not compatible with racing with AIO+DIO, so fix it by adding to wait for all dio before fallocate/punchhole like ext4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Avoid running fallocate/punch_hole while AIO+DIO operations may be racing on OCFS2 (the issue is a race between hole punching and AIO+DIO).
- Operational
After unmounting the filesystem, run fsck.ocfs2 once the filesystem is unmounted.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40943?
CVE-2024-40943 has been assessed with a severity level that highlights the potential impact on system stability.
How do I fix CVE-2024-40943?
To fix CVE-2024-40943, upgrade to the patched versions of the Linux kernel as detailed in the vulnerability report.
What specific versions of Linux are affected by CVE-2024-40943?
CVE-2024-40943 affects specific versions of the Linux kernel including 5.10.223-1, 5.10.226-1, 6.1.119-1, and others.
Is CVE-2024-40943 related to any specific functionality in the Linux kernel?
CVE-2024-40943 is specifically related to issues between hole punching and asynchronous I/O operations within the OCFS2 filesystem.
What should I monitor for regarding CVE-2024-40943?
Monitor your system logs and performance metrics for any anomalies related to file operations or asynchronous input/output tasks.