🛡️ AZL-53373 — kernel

CVE-2024-50250 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved:

fsdax: dax_unshare_iter needs to copy entire blocks

The code that copies data from srcmap to iomap in dax_unshare_iter is

very very broken, which bfoster's recent fsx changes have exposed.

If the pos and len passed to dax_file_unshare are not aligned to an

fsblock boundary, the iter pos and length in the _iter function will

reflect this unalignment.

dax_iomap_direct_access always returns a pointer to the start of the

kmapped fsdax page, even if its pos argument is in the middle of that

page. This is catastrophic for data integrity when iter->pos is not

aligned to a page, because daddr/saddr do not point to the same byte in

the file as iter->pos. Hence we corrupt user data by copying it to the

wrong place.

If iter->pos + iomap_length() in the _iter function not aligned to a

page, then we fail to copy a full block, and only partially populate the

destination block. This is catastrophic for data confidentiality

because we expose stale pmem contents.

Fix both of these issues by aligning copy_pos/copy_len to a page

boundary (remember, this is fsdax so 1 fsblock == 1 base page) so that

we always copy full blocks.

We're not done yet -- there's no call to invalidate_inode_pages2_range,

so programs that have the file range mmap'd will continue accessing the

old memory mapping after the file metadata updates have completed.

Be careful with the return value -- if the unshare succeeds, we still

need to return the number of bytes that the iomap iter thinks we're

operating on.