REDHAT-BUG-2339141: Medium severity Linux Foundation Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix ceph copy to cache on write-begin
At the end of netfsunlockreadfolio() in which folios are marked appropriately for copying to the cache (either with by being marked dirty and having their private data set or by having PGprivate2 set) and then unlocked, the folioqueue struct has the entry pointing to the folio cleared. This presents a problem for netfspgpriv2writetothecache(), which is used to write folios marked with PGprivate2 to the cache as it expects to be able to trawl the folioqueue list thereafter to find the relevant folios, leading to a hang.
Fix this by not clearing the folioqueue entry if we're going to do the deprecated copy-to-cache. The clearance will be done instead as the folios are written to the cache.
This can be reproduced by starting cachefiles, mounting a ceph filesystem with "-o fsc" and writing to it.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using CacheFiles with a Ceph filesystem mounted using the "-o fsc" option are exposed when data is written to that filesystem. The issue is associated with the deprecated copy-to-cache path.
What does an attacker or triggering workload need to do?
The condition can be triggered by writing to a Ceph filesystem mounted with "-o fsc" while CacheFiles is running. No additional attacker prerequisites are provided.
How can I tell whether a system may be affected?
Check whether CacheFiles is running and whether any Ceph filesystem is mounted with the "fsc" mount option. A hang during writes under that configuration is consistent with the described issue.