CVE-2024-53112

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ocfs2: uncache inode which has failed entering the group<br /> <br /> Syzbot has reported the following BUG:<br /> <br /> kernel BUG at fs/ocfs2/uptodate.c:509!<br /> ...<br /> Call Trace:<br /> <br /> ? __die_body+0x5f/0xb0<br /> ? die+0x9e/0xc0<br /> ? do_trap+0x15a/0x3a0<br /> ? ocfs2_set_new_buffer_uptodate+0x145/0x160<br /> ? do_error_trap+0x1dc/0x2c0<br /> ? ocfs2_set_new_buffer_uptodate+0x145/0x160<br /> ? __pfx_do_error_trap+0x10/0x10<br /> ? handle_invalid_op+0x34/0x40<br /> ? ocfs2_set_new_buffer_uptodate+0x145/0x160<br /> ? exc_invalid_op+0x38/0x50<br /> ? asm_exc_invalid_op+0x1a/0x20<br /> ? ocfs2_set_new_buffer_uptodate+0x2e/0x160<br /> ? ocfs2_set_new_buffer_uptodate+0x144/0x160<br /> ? ocfs2_set_new_buffer_uptodate+0x145/0x160<br /> ocfs2_group_add+0x39f/0x15a0<br /> ? __pfx_ocfs2_group_add+0x10/0x10<br /> ? __pfx_lock_acquire+0x10/0x10<br /> ? mnt_get_write_access+0x68/0x2b0<br /> ? __pfx_lock_release+0x10/0x10<br /> ? rcu_read_lock_any_held+0xb7/0x160<br /> ? __pfx_rcu_read_lock_any_held+0x10/0x10<br /> ? smack_log+0x123/0x540<br /> ? mnt_get_write_access+0x68/0x2b0<br /> ? mnt_get_write_access+0x68/0x2b0<br /> ? mnt_get_write_access+0x226/0x2b0<br /> ocfs2_ioctl+0x65e/0x7d0<br /> ? __pfx_ocfs2_ioctl+0x10/0x10<br /> ? smack_file_ioctl+0x29e/0x3a0<br /> ? __pfx_smack_file_ioctl+0x10/0x10<br /> ? lockdep_hardirqs_on_prepare+0x43d/0x780<br /> ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10<br /> ? __pfx_ocfs2_ioctl+0x10/0x10<br /> __se_sys_ioctl+0xfb/0x170<br /> do_syscall_64+0xf3/0x230<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> ...<br /> <br /> <br /> When &amp;#39;ioctl(OCFS2_IOC_GROUP_ADD, ...)&amp;#39; has failed for the particular<br /> inode in &amp;#39;ocfs2_verify_group_and_input()&amp;#39;, corresponding buffer head<br /> remains cached and subsequent call to the same &amp;#39;ioctl()&amp;#39; for the same<br /> inode issues the BUG() in &amp;#39;ocfs2_set_new_buffer_uptodate()&amp;#39; (trying<br /> to cache the same buffer head of that inode). Fix this by uncaching<br /> the buffer head with &amp;#39;ocfs2_remove_from_cache()&amp;#39; on error path in<br /> &amp;#39;ocfs2_group_add()&amp;#39;.