Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC. If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault. Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.
Product status
e897be17a441fa637cd166fc3de1445131e57692 (git) before 7318e3549518ce8f14776a489d86488d80d7e2c8
e897be17a441fa637cd166fc3de1445131e57692 (git) before 449ec5fc99f45974525ba9eea16b6670c45cd363
e897be17a441fa637cd166fc3de1445131e57692 (git) before c36e206f302f1ddefed92d09ecbba070e1ae079e
e897be17a441fa637cd166fc3de1445131e57692 (git) before 41de342278ae025c99cc8d33648773f05e306cf1
e897be17a441fa637cd166fc3de1445131e57692 (git) before 97fb7afec404912d967a7d4715f37742666b3084
e897be17a441fa637cd166fc3de1445131e57692 (git) before 4a4e0328edd9e9755843787d28f16dd4165f8b48
6c3da8c0a35bbafe359d9166269d5590f29664de (git)
605babb979c213737618b1c837e89624e5ab11fd (git)
307d021b1a7f33048b624f7aaeaa75e3eae571f1 (git)
d626fcdabea2258be395a775bdbe09270e9bf73d (git)
d05cc5395e36711edad8bdef6945f138d8a7097b (git)
1829b24a36ca12ca95b96d5478faeff40c17f2b6 (git)
5.18
Any version before 5.18
6.6.136 (semver)
6.12.83 (semver)
6.18.24 (semver)
6.19.14 (semver)
7.0.1 (semver)
7.1-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/7318e3549518ce8f14776a489d86488d80d7e2c8
git.kernel.org/...c/449ec5fc99f45974525ba9eea16b6670c45cd363
git.kernel.org/...c/c36e206f302f1ddefed92d09ecbba070e1ae079e
git.kernel.org/...c/41de342278ae025c99cc8d33648773f05e306cf1
git.kernel.org/...c/97fb7afec404912d967a7d4715f37742666b3084
git.kernel.org/...c/4a4e0328edd9e9755843787d28f16dd4165f8b48