Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]pNFS: Fix uninited ptr deref in block/scsi layout[EOL][EOL]The error occurs on the third attempt to encode extents. When function[EOL]ext_tree_prepare_commit() reallocates a larger buffer to retry encoding[EOL]extents, the "layoutupdate_pages" page array is initialized only after the[EOL]retry loop. But ext_tree_free_commitdata() is called on every iteration[EOL]and tries to put pages in the array, thus dereferencing uninitialized[EOL]pointers.[EOL][EOL]An additional problem is that there is no limit on the maximum possible[EOL]buffer_size. When there are too many extents, the client may create a[EOL]layoutcommit that is larger than the maximum possible RPC size accepted[EOL]by the server.[EOL][EOL]During testing, we observed two typical scenarios. First, one memory page[EOL]for extents is enough when we work with small files, append data to the[EOL]end of the file, or preallocate extents before writing. But when we fill[EOL]a new large file without preallocating, the number of extents can be huge,[EOL]and counting the number of written extents in ext_tree_encode_commit()[EOL]does not help much. Since this number increases even more between[EOL]unlocking and locking of ext_tree, the reallocated buffer may not be[EOL]large enough again and again.

CREATE(Triage):(User=admin) [CVE-2025-38691 (https://nvd.nist.gov/vuln/detail/CVE-2025-38691)