CVE-2022-50126

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix assertion 'jh->bfrozendata == NULL' failure when journal aborted

Following process will fail assertion 'jh->bfrozendata == NULL' in jbd2journaldirty_metadata():

               jbd2_journal_commit_transaction

unlink(dir/a) jh->btransaction = trans1 jh->bjlist = BJMetadata journal->jrunningtransaction = NULL trans1->tstate = TCOMMIT unlink(dir/b) handle->htrans = trans2 dogetwriteaccess jh->bmodified = 0 jh->bfrozendata = frozenbuffer jh->bnexttransaction = trans2 jbd2journaldirtymetadata ishandleaborted isjournalaborted // return false

       --> jbd2 abort <--

                 while (commit_transaction->t_buffers)
                  if (is_journal_aborted)
                   jbd2_journal_refile_buffer
                    __jbd2_journal_refile_buffer
                     WRITE_ONCE(jh->b_transaction,
                    jh->b_next_transaction)
                     WRITE_ONCE(jh->b_next_transaction, NULL)
                     __jbd2_journal_file_buffer(jh, BJ_Reserved)
    J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !

The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2journaldirtymetadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> _ext4handledirtymetadata+0xa0/0x290 ext4handledirtydirblock+0x10c/0x1d0 ext4deleteentry+0x104/0x200 _ext4unlink+0x22b/0x360 ext4unlink+0x275/0x390 vfsunlink+0x20b/0x4c0 dounlinkat+0x42f/0x4c0 _x64sysunlink+0x37/0x50 dosyscall64+0x35/0x80

After journal aborting, _jbd2journalrefilebuffer() is executed with holding @jh->bstatelock, we can fix it by moving 'ishandleaborted()' into the area protected by @jh->bstatelock.