CVE-2026-90420: nilfs2: fix infinite loop in nilfs_clean_segments()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix infinite loop in nilfscleansegments()
syzbot reported a hung task in nilfstransactionbegin(). This occurs because the cleaner ioctl falls into an infinite loop if nilfssegctorconstruct() repeatedly returns -EROFS (e.g. the device is remounted as read-only after an I/O error).
Currently in nilfscleansegments(), if err is non-zero, it logs the error and sleeps but doesn't abort when it encounters a terminal error like -EROFS. This causes the thread to loop forever.
Fix this by breaking out of the loop if nilfssegctorconstruct() returns -EROFS. This matches the behaviour in nilfssegctorwriteout(), which also handles -EROFS.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the hang?
The NILFS2 cleaner ioctl must be running, and nilfs_segctor_construct() must repeatedly return -EROFS. One example is a NILFS2 device being remounted read-only after an I/O error.
What is the operational impact if the issue is triggered?
The cleaner path can loop indefinitely, and syzbot observed a hung task in nilfs_transaction_begin(). The affected thread continues logging errors and sleeping rather than terminating the operation.
What can be done before the fix is deployed?
Avoid running the NILFS2 cleaner ioctl against filesystems or devices that have been remounted read-only, particularly following I/O errors. Investigate and remediate the underlying storage error before retrying cleaner operations.