{"api_version":"1","generated_at":"2026-08-04T14:27:30+00:00","cve":"CVE-2022-49834","urls":{"html":"https://cve.report/CVE-2022-49834","api":"https://cve.report/api/cve/CVE-2022-49834.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-49834","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-49834"},"summary":{"title":"nilfs2: fix use-after-free bug of ns_writer on remount","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of ns_writer on remount\n\nIf a nilfs2 filesystem is downgraded to read-only due to metadata\ncorruption on disk and is remounted read/write, or if emergency read-only\nremount is performed, detaching a log writer and synchronizing the\nfilesystem can be done at the same time.\n\nIn these cases, use-after-free of the log writer (hereinafter\nnilfs->ns_writer) can happen as shown in the scenario below:\n\n Task1                               Task2\n --------------------------------    ------------------------------\n nilfs_construct_segment\n   nilfs_segctor_sync\n     init_wait\n     init_waitqueue_entry\n     add_wait_queue\n     schedule\n                                     nilfs_remount (R/W remount case)\n\t\t\t\t       nilfs_attach_log_writer\n                                         nilfs_detach_log_writer\n                                           nilfs_segctor_destroy\n                                             kfree\n     finish_wait\n       _raw_spin_lock_irqsave\n         __raw_spin_lock_irqsave\n           do_raw_spin_lock\n             debug_spin_lock_before  <-- use-after-free\n\nWhile Task1 is sleeping, nilfs->ns_writer is freed by Task2.  After Task1\nwaked up, Task1 accesses nilfs->ns_writer which is already freed.  This\nscenario diagram is based on the Shigeru Yoshida's post [1].\n\nThis patch fixes the issue by not detaching nilfs->ns_writer on remount so\nthat this UAF race doesn't happen.  Along with this change, this patch\nalso inserts a few necessary read-only checks with superblock instance\nwhere only the ns_writer pointer was used to check if the filesystem is\nread-only.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-05-01 15:16:06","updated_at":"2026-08-04 10:17:57"},"problem_types":["CWE-416"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/afbd1188382a75f6cfe22c0b68533f7f9664f182","name":"https://git.kernel.org/stable/c/afbd1188382a75f6cfe22c0b68533f7f9664f182","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/39a3ed68270b079c6b874d4e4727a512b9b4882c","name":"https://git.kernel.org/stable/c/39a3ed68270b079c6b874d4e4727a512b9b4882c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b4736ab5542112fe0a40f140a0a0b072954f34da","name":"https://git.kernel.org/stable/c/b4736ab5542112fe0a40f140a0a0b072954f34da","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b2fbf10040216ef5ee270773755fc2f5da65b749","name":"https://git.kernel.org/stable/c/b2fbf10040216ef5ee270773755fc2f5da65b749","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b152300d5a1ba4258dacf9916bff20e6a8c7603b","name":"https://git.kernel.org/stable/c/b152300d5a1ba4258dacf9916bff20e6a8c7603b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4feedde5486c07ea79787839153a71ca71329c7d","name":"https://git.kernel.org/stable/c/4feedde5486c07ea79787839153a71ca71329c7d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8cccf05fe857a18ee26e20d11a8455a73ffd4efd","name":"https://git.kernel.org/stable/c/8cccf05fe857a18ee26e20d11a8455a73ffd4efd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9b162e81045266a2d5b44df9dffdf05c54de9cca","name":"https://git.kernel.org/stable/c/9b162e81045266a2d5b44df9dffdf05c54de9cca","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-49834","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49834","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a b2fbf10040216ef5ee270773755fc2f5da65b749 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a 39a3ed68270b079c6b874d4e4727a512b9b4882c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a b4736ab5542112fe0a40f140a0a0b072954f34da git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a 9b162e81045266a2d5b44df9dffdf05c54de9cca git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a 4feedde5486c07ea79787839153a71ca71329c7d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a afbd1188382a75f6cfe22c0b68533f7f9664f182 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a b152300d5a1ba4258dacf9916bff20e6a8c7603b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a 8cccf05fe857a18ee26e20d11a8455a73ffd4efd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.34","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.34 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.9.334 4.9.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14.300 4.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.267 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.225 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.155 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.79 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.0.9 6.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"49834","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nilfs2/segment.c","fs/nilfs2/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2fbf10040216ef5ee270773755fc2f5da65b749","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"39a3ed68270b079c6b874d4e4727a512b9b4882c","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"b4736ab5542112fe0a40f140a0a0b072954f34da","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"9b162e81045266a2d5b44df9dffdf05c54de9cca","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"4feedde5486c07ea79787839153a71ca71329c7d","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"afbd1188382a75f6cfe22c0b68533f7f9664f182","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"b152300d5a1ba4258dacf9916bff20e6a8c7603b","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"},{"lessThan":"8cccf05fe857a18ee26e20d11a8455a73ffd4efd","status":"affected","version":"fe5f171bb272946ce5fbf843ce2f8467d0d41b9a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nilfs2/segment.c","fs/nilfs2/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.34"},{"lessThan":"2.6.34","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.334","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.300","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.267","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.225","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.155","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.79","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.334","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.14.300","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.267","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.225","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.155","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.79","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.9","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1","versionStartIncluding":"2.6.34","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of ns_writer on remount\n\nIf a nilfs2 filesystem is downgraded to read-only due to metadata\ncorruption on disk and is remounted read/write, or if emergency read-only\nremount is performed, detaching a log writer and synchronizing the\nfilesystem can be done at the same time.\n\nIn these cases, use-after-free of the log writer (hereinafter\nnilfs->ns_writer) can happen as shown in the scenario below:\n\n Task1                               Task2\n --------------------------------    ------------------------------\n nilfs_construct_segment\n   nilfs_segctor_sync\n     init_wait\n     init_waitqueue_entry\n     add_wait_queue\n     schedule\n                                     nilfs_remount (R/W remount case)\n\t\t\t\t       nilfs_attach_log_writer\n                                         nilfs_detach_log_writer\n                                           nilfs_segctor_destroy\n                                             kfree\n     finish_wait\n       _raw_spin_lock_irqsave\n         __raw_spin_lock_irqsave\n           do_raw_spin_lock\n             debug_spin_lock_before  <-- use-after-free\n\nWhile Task1 is sleeping, nilfs->ns_writer is freed by Task2.  After Task1\nwaked up, Task1 accesses nilfs->ns_writer which is already freed.  This\nscenario diagram is based on the Shigeru Yoshida's post [1].\n\nThis patch fixes the issue by not detaching nilfs->ns_writer on remount so\nthat this UAF race doesn't happen.  Along with this change, this patch\nalso inserts a few necessary read-only checks with superblock instance\nwhere only the ns_writer pointer was used to check if the filesystem is\nread-only."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:06:43.661Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b2fbf10040216ef5ee270773755fc2f5da65b749"},{"url":"https://git.kernel.org/stable/c/39a3ed68270b079c6b874d4e4727a512b9b4882c"},{"url":"https://git.kernel.org/stable/c/b4736ab5542112fe0a40f140a0a0b072954f34da"},{"url":"https://git.kernel.org/stable/c/9b162e81045266a2d5b44df9dffdf05c54de9cca"},{"url":"https://git.kernel.org/stable/c/4feedde5486c07ea79787839153a71ca71329c7d"},{"url":"https://git.kernel.org/stable/c/afbd1188382a75f6cfe22c0b68533f7f9664f182"},{"url":"https://git.kernel.org/stable/c/b152300d5a1ba4258dacf9916bff20e6a8c7603b"},{"url":"https://git.kernel.org/stable/c/8cccf05fe857a18ee26e20d11a8455a73ffd4efd"}],"title":"nilfs2: fix use-after-free bug of ns_writer on remount","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2022-49834","datePublished":"2025-05-01T14:09:52.076Z","dateReserved":"2025-05-01T14:05:17.228Z","dateUpdated":"2026-08-04T09:06:43.661Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-05-01 15:16:06","lastModifiedDate":"2026-08-04 10:17:57","problem_types":["CWE-416"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.334","matchCriteriaId":"65416FEB-3A76-4DA9-A96A-1479EC77AFB6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"4.14.300","matchCriteriaId":"424802D2-E9E7-48A9-AD6F-DF2227B3D83A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"4.19.267","matchCriteriaId":"A5C69A12-68E2-400E-9A5A-375A673C8402"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.225","matchCriteriaId":"94D21814-3051-4860-AB06-C7880A3D4933"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.155","matchCriteriaId":"172AC75C-0949-4468-9C58-64E2893EF0CE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.79","matchCriteriaId":"39DC45D8-E30E-4F4A-9332-393B7BCF6900"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.0.9","matchCriteriaId":"C3F26709-7D49-4AF0-8145-46CCF4E8E2AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*","matchCriteriaId":"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*","matchCriteriaId":"17F0B248-42CF-4AE6-A469-BB1BAE7F4705"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*","matchCriteriaId":"E2422816-0C14-4B5E-A1E6-A9D776E5C49B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*","matchCriteriaId":"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"49834","Ordinal":"1","Title":"nilfs2: fix use-after-free bug of ns_writer on remount","CVE":"CVE-2022-49834","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"49834","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of ns_writer on remount\n\nIf a nilfs2 filesystem is downgraded to read-only due to metadata\ncorruption on disk and is remounted read/write, or if emergency read-only\nremount is performed, detaching a log writer and synchronizing the\nfilesystem can be done at the same time.\n\nIn these cases, use-after-free of the log writer (hereinafter\nnilfs->ns_writer) can happen as shown in the scenario below:\n\n Task1                               Task2\n --------------------------------    ------------------------------\n nilfs_construct_segment\n   nilfs_segctor_sync\n     init_wait\n     init_waitqueue_entry\n     add_wait_queue\n     schedule\n                                     nilfs_remount (R/W remount case)\n\t\t\t\t       nilfs_attach_log_writer\n                                         nilfs_detach_log_writer\n                                           nilfs_segctor_destroy\n                                             kfree\n     finish_wait\n       _raw_spin_lock_irqsave\n         __raw_spin_lock_irqsave\n           do_raw_spin_lock\n             debug_spin_lock_before  <-- use-after-free\n\nWhile Task1 is sleeping, nilfs->ns_writer is freed by Task2.  After Task1\nwaked up, Task1 accesses nilfs->ns_writer which is already freed.  This\nscenario diagram is based on the Shigeru Yoshida's post [1].\n\nThis patch fixes the issue by not detaching nilfs->ns_writer on remount so\nthat this UAF race doesn't happen.  Along with this change, this patch\nalso inserts a few necessary read-only checks with superblock instance\nwhere only the ns_writer pointer was used to check if the filesystem is\nread-only.","Type":"Description","Title":"nilfs2: fix use-after-free bug of ns_writer on remount"}]}}}