In the Linux kernel, the following vulnerability has been resolved:
nilfs2: do not force clear folio if buffer is referenced
Patch series "nilfs2: protect busy buffer heads from being force-cleared".
This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue.
This patch (of 2):
Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur.
One of the inconsistencies is that when nilfs2 calls markbufferdirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state:
WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 markbufferdirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfspalloccommitallocentry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfsifilecreateinode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfsnewinode+0x254/0x830 fs/nilfs2/inode.c:344 nilfsmkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfsmkdir+0x2f9/0x4f0 fs/namei.c:4257 domkdirat+0x264/0x3a0 fs/namei.c:4280 _dosysmkdirat fs/namei.c:4295 [inline] _sesysmkdirat fs/namei.c:4293 [inline] _x64sysmkdirat+0x87/0xa0 fs/namei.c:4293 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f
The other is when nilfsbtreepropagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be:
WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfsbtreepropagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfsbmappropagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfscollectfiledata+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfssegctorapplybuffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfssegctorscanfile+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfssegctorcollectblocks fs/nilfs2/segment.c:1216 [inline] nilfssegctorcollect fs/nilfs2/segment.c:1540 [inline] nilfssegctordoconstruct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfssegctorconstruct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfssegctorthreadconstruct fs/nilfs2/segment.c:2587 [inline] nilfssegctorthread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 </TASK>
Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback.
Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 630.0,
"function_hash": "316337244598079585858708412757531741365"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557ccf5e49f1fb848a29698585bcab2e50a597ef",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_folio_dirty"
},
"id": "CVE-2025-21722-0505bb39"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"170350378454126433576176087508145610604",
"54078842465055974146919198977089635611",
"25467659847329501087990152806552770088",
"303706208836481571592313446651117611679",
"177488680868862375621788346933565301327",
"127392002481263774084346174014944114618",
"338233438442942995745488496499773461715",
"236703686394529690967253991506884387321",
"194380733689308977077596040071449857435",
"141510093982129601668476140312898450401",
"254148565050387568224473031505928073730",
"239546390035879068847186535967949440621",
"208030449098702630169303928399832002794",
"75139204891273112686256354311823286488",
"154178560438478200589032957287718042884",
"302641784478523557264077403770517257607",
"55953027457906179540080419795768821330",
"218265595852391754928257163941987111879",
"192598402618574704025562032034702518254",
"199150290952207728302736143517657565142"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19296737024cd220a1d6590bf4c092bca8c99497",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-3d192280"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 639.0,
"function_hash": "318199764945647370162780575773683677658"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19296737024cd220a1d6590bf4c092bca8c99497",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_dirty_page"
},
"id": "CVE-2025-21722-6b2deb32"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"170350378454126433576176087508145610604",
"54078842465055974146919198977089635611",
"25467659847329501087990152806552770088",
"303706208836481571592313446651117611679",
"177488680868862375621788346933565301327",
"127392002481263774084346174014944114618",
"338233438442942995745488496499773461715",
"236703686394529690967253991506884387321",
"194380733689308977077596040071449857435",
"141510093982129601668476140312898450401",
"254148565050387568224473031505928073730",
"239546390035879068847186535967949440621",
"208030449098702630169303928399832002794",
"75139204891273112686256354311823286488",
"154178560438478200589032957287718042884",
"302641784478523557264077403770517257607",
"55953027457906179540080419795768821330",
"218265595852391754928257163941987111879",
"192598402618574704025562032034702518254",
"199150290952207728302736143517657565142"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d0544bacc11d6aa26ecd7debf9353193c7a3328",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-81cf7e07"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 639.0,
"function_hash": "318199764945647370162780575773683677658"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d042811c72f71be7c14726db2c72b67025a7cb5",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_dirty_page"
},
"id": "CVE-2025-21722-96895ca9"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 639.0,
"function_hash": "318199764945647370162780575773683677658"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d0544bacc11d6aa26ecd7debf9353193c7a3328",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_dirty_page"
},
"id": "CVE-2025-21722-a2c5a50f"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203063327454179725909616550031302296078",
"12322017603746474287686334290919672615",
"1191587409632018357850740378757425662",
"12331873865311691086341122361938285481",
"28178022709943180225684828699477830256",
"289298943685822582454358303855171045637",
"260303908724134101885075766112841989570",
"18953655948393227998981470156220504110",
"63461598383821659007635301606494310738",
"208030449098702630169303928399832002794",
"100505908851688749020370592451512474421",
"167356482644864271015322357455303675806",
"192925318193415991359150764098455362393",
"227268909250146157779932538907007146850",
"53812818935397186458507020828264430320",
"263303568033871428950872318145710417641"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557ccf5e49f1fb848a29698585bcab2e50a597ef",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-b6b38d93"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"170350378454126433576176087508145610604",
"54078842465055974146919198977089635611",
"25467659847329501087990152806552770088",
"303706208836481571592313446651117611679",
"177488680868862375621788346933565301327",
"127392002481263774084346174014944114618",
"338233438442942995745488496499773461715",
"236703686394529690967253991506884387321",
"194380733689308977077596040071449857435",
"141510093982129601668476140312898450401",
"254148565050387568224473031505928073730",
"239546390035879068847186535967949440621",
"208030449098702630169303928399832002794",
"75139204891273112686256354311823286488",
"154178560438478200589032957287718042884",
"302641784478523557264077403770517257607",
"55953027457906179540080419795768821330",
"218265595852391754928257163941987111879",
"192598402618574704025562032034702518254",
"199150290952207728302736143517657565142"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f51ff43c4c5a6c8e72d0aca89e4d5e688938412f",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-c0104335"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 639.0,
"function_hash": "318199764945647370162780575773683677658"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f51ff43c4c5a6c8e72d0aca89e4d5e688938412f",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_dirty_page"
},
"id": "CVE-2025-21722-c16b61af"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203063327454179725909616550031302296078",
"12322017603746474287686334290919672615",
"1191587409632018357850740378757425662",
"12331873865311691086341122361938285481",
"28178022709943180225684828699477830256",
"289298943685822582454358303855171045637",
"260303908724134101885075766112841989570",
"18953655948393227998981470156220504110",
"63461598383821659007635301606494310738",
"208030449098702630169303928399832002794",
"100505908851688749020370592451512474421",
"167356482644864271015322357455303675806",
"192925318193415991359150764098455362393",
"227268909250146157779932538907007146850",
"53812818935397186458507020828264430320",
"263303568033871428950872318145710417641"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca76bb226bf47ff04c782cacbd299f12ddee1ec1",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-c3574b08"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 630.0,
"function_hash": "316337244598079585858708412757531741365"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca76bb226bf47ff04c782cacbd299f12ddee1ec1",
"target": {
"file": "fs/nilfs2/page.c",
"function": "nilfs_clear_folio_dirty"
},
"id": "CVE-2025-21722-c7a2edc1"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"170350378454126433576176087508145610604",
"54078842465055974146919198977089635611",
"25467659847329501087990152806552770088",
"303706208836481571592313446651117611679",
"177488680868862375621788346933565301327",
"127392002481263774084346174014944114618",
"338233438442942995745488496499773461715",
"236703686394529690967253991506884387321",
"194380733689308977077596040071449857435",
"141510093982129601668476140312898450401",
"254148565050387568224473031505928073730",
"239546390035879068847186535967949440621",
"208030449098702630169303928399832002794",
"75139204891273112686256354311823286488",
"154178560438478200589032957287718042884",
"302641784478523557264077403770517257607",
"55953027457906179540080419795768821330",
"218265595852391754928257163941987111879",
"192598402618574704025562032034702518254",
"199150290952207728302736143517657565142"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d042811c72f71be7c14726db2c72b67025a7cb5",
"target": {
"file": "fs/nilfs2/page.c"
},
"id": "CVE-2025-21722-f41dad90"
}
]