{"id":"CVE-2024-50265","summary":"ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()\n\nSyzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():\n\n[   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12\n[   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry\n[   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004\n[...]\n[   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0\n[...]\n[   57.331328] Call Trace:\n[   57.331477]  \u003cTASK\u003e\n[...]\n[   57.333511]  ? do_user_addr_fault+0x3e5/0x740\n[   57.333778]  ? exc_page_fault+0x70/0x170\n[   57.334016]  ? asm_exc_page_fault+0x2b/0x30\n[   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10\n[   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0\n[   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0\n[   57.335164]  ocfs2_xa_set+0x704/0xcf0\n[   57.335381]  ? _raw_spin_unlock+0x1a/0x40\n[   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20\n[   57.335915]  ? trace_preempt_on+0x1e/0x70\n[   57.336153]  ? start_this_handle+0x16c/0x500\n[   57.336410]  ? preempt_count_sub+0x50/0x80\n[   57.336656]  ? _raw_read_unlock+0x20/0x40\n[   57.336906]  ? start_this_handle+0x16c/0x500\n[   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0\n[   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0\n[   57.337706]  ? ocfs2_start_trans+0x13d/0x290\n[   57.337971]  ocfs2_xattr_set+0xb13/0xfb0\n[   57.338207]  ? dput+0x46/0x1c0\n[   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30\n[   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30\n[   57.338948]  __vfs_removexattr+0x92/0xc0\n[   57.339182]  __vfs_removexattr_locked+0xd5/0x190\n[   57.339456]  ? preempt_count_sub+0x50/0x80\n[   57.339705]  vfs_removexattr+0x5f/0x100\n[...]\n\nReproducer uses faultinject facility to fail ocfs2_xa_remove() -\u003e\nocfs2_xa_value_truncate() with -ENOMEM.\n\nIn this case the comment mentions that we can return 0 if\nocfs2_xa_cleanup_value_truncate() is going to wipe the entry\nanyway. But the following 'rc' check is wrong and execution flow do\n'ocfs2_xa_remove_entry(loc);' twice:\n* 1st: in ocfs2_xa_cleanup_value_truncate();\n* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.\n\nFix this by skipping the 2nd removal of the same entry and making\nsyzkaller repro happy.","modified":"2026-04-02T12:21:22.397456Z","published":"2024-11-19T01:30:00.861Z","related":["SUSE-SU-2024:4314-1","SUSE-SU-2024:4315-1","SUSE-SU-2024:4316-1","SUSE-SU-2024:4318-1","SUSE-SU-2024:4364-1","SUSE-SU-2024:4367-1","SUSE-SU-2024:4376-1","SUSE-SU-2024:4387-1","SUSE-SU-2025:0035-1","SUSE-SU-2025:20163-1","SUSE-SU-2025:20164-1","SUSE-SU-2025:20246-1","SUSE-SU-2025:20247-1","USN-7276-1","USN-7277-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50265.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0b63c0e01fba40e3992bc627272ec7b618ccaef7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/168a9b8303fcb0317db4c06b23ce1c0ce2af4e10"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2b5369528ee63c88371816178a05b5e664c87386"},{"type":"WEB","url":"https://git.kernel.org/stable/c/38cbf13b2e7a31362babe411f7c2c3c52cd2734b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6a7e6dcf90fe7721d0863067b6ca9a9442134692"},{"type":"WEB","url":"https://git.kernel.org/stable/c/86dd0e8d42828923c68ad506933336bcd6f2317d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dcc8fe8c83145041cb6c80cac21f6173a3ff0204"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dd73c942eed76a014c7a5597e6926435274d2c4c"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50265.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50265"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"399ff3a748cf4c8c853e96dd477153202636527b"},{"fixed":"38cbf13b2e7a31362babe411f7c2c3c52cd2734b"},{"fixed":"168a9b8303fcb0317db4c06b23ce1c0ce2af4e10"},{"fixed":"6a7e6dcf90fe7721d0863067b6ca9a9442134692"},{"fixed":"dcc8fe8c83145041cb6c80cac21f6173a3ff0204"},{"fixed":"86dd0e8d42828923c68ad506933336bcd6f2317d"},{"fixed":"dd73c942eed76a014c7a5597e6926435274d2c4c"},{"fixed":"2b5369528ee63c88371816178a05b5e664c87386"},{"fixed":"0b63c0e01fba40e3992bc627272ec7b618ccaef7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50265.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}