Linux Kernel Netfs Cache Handling Vulnerability in Ceph

A vulnerability in the Linux kernel's netfs component affects the handling of cache for files when using the deprecated PG_private_2 method, as seen with Ceph. When direct I/O writes disable caching for a file, future cache copying is halted until all file descriptors are closed. However, if netfs_lib attempts to copy to the cache while caching is disabled, the operation fails without properly managing the request. This oversight causes requests to be discarded, leaving associated folios in an inconsistent state. The vulnerability was identified by running a specific xfstest against Ceph with an active cache and the 'fsc' option, which typically causes a hang.

Impact

The vulnerability can lead to a denial of service, causing operations to hang indefinitely.

Reproduction

The vulnerability can be reproduced by using Ceph with the 'fsc' option enabled, while the cache is temporarily disabled due to direct I/O writes. This combination causes netfs_advance_write() to fail, leaving folios in a state that disrupts normal operations.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed.