Linux Kernel Zone File Readahead Vulnerability in Zonefs by Linux

CVE-2022-49706

Summary

In the Linux kernel, a vulnerability exists within the zonefs implementation that affects how readahead operations are handled for sequential zone files. When a readahead is issued with an offset matching the current file size, the system erroneously sets the iomap type to IOMAP_UNWRITTEN. This misconfiguration prevents the I/O operation from proceeding, while simultaneously calculating the iomap length as zero, leading to unexpected behavior within the iomap_iter() function. As a result, the system can enter an infinite loop during readahead operations. The fix involves correctly interpreting reads beyond the file size as attempts to access unallocated areas, adjusting the iomap type to IOMAP_HOLE, while ensuring that other related functions are split to streamline code management.

References