Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-38337

jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: ================================================================== BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... value changed: 0x00000000 -> 0x00000001 ================================================================== This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < 5c1a34ff5b0bfdfd2f9343aa9b08d25df618bac5affected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < ec669e5bf409f16e464bfad75f0ba039a45de29aaffected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < 43d5e3bb5f1dcd91e30238ea0b59a5f77063f84eaffected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < 23361b479f2700c00960d3ae9cdc8ededa762d47affected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < 2e7c64d7a92c031d016f11c8e8cb05131ab7b75aaffected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < f78b38af3540b4875147b7b884ee11a27b3dbf4caffected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < a377996d714afb8d4d5f4906336f78510039da29affected
  • 6e06ae88edae77379bef7c0cb7d3c2dd88676867 to < af98b0157adf6504fade79b3e6cb260c4ff68e37affected

Linux Linux

Default version status: affected

  • 4.3affected
  • 0 to < 4.3unaffected
  • 5.4.295 to ≤ 5.4.*unaffected
  • 5.10.239 to ≤ 5.10.*unaffected
  • 5.15.186 to ≤ 5.15.*unaffected
  • 6.1.142 to ≤ 6.1.*unaffected
  • 6.6.95 to ≤ 6.6.*unaffected
  • 6.12.35 to ≤ 6.12.*unaffected
  • 6.15.4 to ≤ 6.15.*unaffected
  • 6.16 to ≤ *unaffected

References