🛡️ CVE-2026-43188 — kernel

ceph: do not propagate page array emplacement errors as batch errors

In the Linux kernel, the following vulnerability has been resolved:

ceph: do not propagate page array emplacement errors as batch errors

When fscrypt is enabled, move_dirty_folio_in_page_array() may fail

because it needs to allocate bounce buffers to store the encrypted

versions of each folio. Each folio beyond the first allocates its bounce

buffer with GFP_NOWAIT. Failures are common (and expected) under this

allocation mode; they should flush (not abort) the batch.

However, ceph_process_folio_batch() uses the same rc variable for its

own return code and for capturing the return codes of its routine calls;

failing to reset rc back to 0 results in the error being propagated

out to the main writeback loop, which cannot actually tolerate any

errors here: once ceph_wbc.pages is allocated, it must be passed to

ceph_submit_write() to be freed. If it survives until the next iteration

(e.g. due to the goto being followed), ceph_allocate_page_array()'s

BUG_ON() will oops the worker.

Note that this failure mode is currently masked due to another bug

(addressed next in this series) that prevents multiple encrypted folios

from being selected for the same write.

For now, just reset rc when redirtying the folio to prevent errors in

move_dirty_folio_in_page_array() from propagating. Note that

move_dirty_folio_in_page_array() is careful never to return errors on

the first folio, so there is no need to check for that. After this

change, ceph_process_folio_batch() no longer returns errors; its only

remaining failure indicator is locked_pages == 0, which the caller

already handles correctly.