Linux Kernel ext4 Shared Mapping Race Condition Data Corruption Fix Analysis

Vulnerability Key Information Summary Vulnerability Overview This commit fixes a defect in the ext4 filesystem regarding valid size extension under a shared writable mapping. Problem Description: When a shared writable mapping exists, ext4 zeros out pages in the page cache that are located before the new valid size. If storage writes through this mapping during this zeroing process, a race condition may occur with the zeroing operation, potentially causing data corruption. Fix Approach: Lazily fix the gap: Defer zeroing of pages until after all pages faulted on first write have been zeroed. Use the flag to ensure zeroing is completed before storage installs writable PTEs, allocates faulted pages, and locks the page valid size. Use the flag to address the issue where uninitialized cache content at the file tail overwrites disk blocks. Scope of Impact Affected Components: Linux kernel ext4 filesystem ( ) Key Functions: - - - - - - Trigger Condition: A shared writable mapping exists, and the valid size is being extended, causing the zeroing operation and the write operation to execute concurrently. Fix Approach (Core Code Changes) 1. Function Modification 2. Function Modification 3. Function Modification 4. Function Modification 5. Function Modification 6. Function Modification 7. Function Modification 8. Function Modification 9. Function Modification 10. Function Modification ```c static vm_fault_t ext4_filemap_fault(struct vm_fault vma) { struct inode inode = file_inode(vma->vm_file); struct ext4_inode_info ei = EXT4_I(inode); loff_t start = vma->vm_pgoff vm_pgoff + 1) vm_end, ei->zeroed_size); loff_t old_valid_size = ei->zeroed_size; int err; if (ei->zeroed_size < new_valid_size) { / Only zero the range that hasn't been zeroed yet for this mmap write path. zeroed_size tracks the largest page-aligned size zeroed in the page cache (== valid size). This prevents unnecessarily zeroing out the entire tail page on every data fault when userspace writes data-to-be-by-the-unmapped map after a fault.

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel ext4 Shared Mapping Race Condition Data Corruption Fix Analysis