Linux Kernel DAX Cache Inode Flushing Vulnerability

A vulnerability in the Linux kernel's DAX (Direct Access) feature has been identified, where inodes are not properly flushed before the DAX cache is destroyed. This issue can be triggered by loading the 'nd_pmem' module and then removing it, which exposes remaining objects in the DAX cache that should have been cleared. The vulnerability arises because the 'dax_fs_exit()' function fails to flush inodes prior to cache destruction, leading to a potential memory management issue.

Impact

Exploitation of this vulnerability can result in a memory management error, where objects remain in the DAX cache despite the cache being shut down, potentially leading to undefined behavior or system instability.

Reproduction

To reproduce this vulnerability, load the 'nd_pmem' module using 'modprobe', then remove it with 'modprobe -r nd_pmem'. This sequence will trigger a bug where objects are left in the DAX cache, indicating that inodes were not flushed before the cache was destroyed.

Remediation

The vulnerability can be addressed by modifying the 'dax_fs_exit()' function to include a call to 'rcu_barrier()' before the cache destruction process.