Description
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: avoid having an active sc_timer before freeing sci
Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed.
Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer.
We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned.
[1] ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509
Metrics
No CVSS score has been published yet.
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 3f66cc261ccb54a8e4d8d5aa51c389c19453b00c, < 36049e81dc7f077e0e24d5b9688a7458beacef8f; >= 3f66cc261ccb54a8e4d8d5aa51c389c19453b00c, < 2f65799e2a736d556d306440c4e1e8906736117a; >= 3f66cc261ccb54a8e4d8d5aa51c389c19453b00c, < 9a6b60cb147d53968753a34805211d2e5e08c027 |
| Linux | Linux | 6.12 |
References
Timeline
- Published
- Dec 16, 2025
- Last modified
- Oct 14, 2026
- NVD status
- Deferred