jbd2: bound shrinker scans by examined checkpoint buffers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.16, 6.2, 6.5, 6.6.160, 6.12.109, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls. Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved. This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in 6b5366ba63a58819396045ab146bd37ff9e503c6; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in edf5fcd0469b7467bd5b37a79502c8d9c3257dbb; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in 71c6b872c746465fa4b5def239cb296173ca8216; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in c2c0fb364685b8996c357d3b050394959b29d6e0; From b98dba273a0e47dbfade89c9af73c5b012a4eabb · fixed in 15cb16496446b94e67f7abcb049b8e2c75cd3d02; From 5.15.129 · fixed in 5.16; From 6.1.50 · fixed in 6.2; From 6.4.13 · fixed in 6.5
- Linux Linux
6.5
- KernelLinux
From 6.5.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4