Bug 2420365 (CVE-2023-53845)

Summary: CVE-2023-53845 kernel: nilfs2: fix infinite loop in nilfs_mdt_get_block()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An infinite loop vulnerability was found in the NILFS2 filesystem in the Linux kernel. When mounting a corrupted disk image where a virtual block address is invalid, nilfs_bmap_lookup_at_level() returns an error code that is misinterpreted by nilfs_mdt_get_block(). This causes an infinite loop attempting to read and create metadata blocks. When this affects the inode file (ifile), the i_rwsem semaphore remains held, causing task hangs during mount operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-09 02:05:55 UTC 
In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix infinite loop in nilfs_mdt_get_block()

If the disk image that nilfs2 mounts is corrupted and a virtual block
address obtained by block lookup for a metadata file is invalid,
nilfs_bmap_lookup_at_level() may return the same internal return code as
-ENOENT, meaning the block does not exist in the metadata file.

This duplication of return codes confuses nilfs_mdt_get_block(), causing
it to read and create a metadata block indefinitely.

In particular, if this happens to the inode metadata file, ifile,
semaphore i_rwsem can be left held, causing task hangs in lock_mount.

Fix this issue by making nilfs_bmap_lookup_at_level() treat virtual block
address translation failures with -ENOENT as metadata corruption instead
of returning the error code.
Comment 1 Alexander B 2025-12-09 16:28:36 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025120959-CVE-2023-53845-b919@gregkh/T