CVE-2021-47460: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47460 addresses a data corruption vulnerability in the Linux kernel's OCFS2 filesystem when converting files from inline format to normal inode format. The issue was discovered when changes to page buffer invalidation behavior exposed a latent bug in the conversion process (Kernel Git).

The vulnerability occurs in the ocfs2_convert_inline_data_to_extents() function, which attempts to zero out an entire cluster allocated for file data. The code grabs, zeroes, and marks pages as dirty beyond the file's i_size limit. However, the writeback code typically ignores these dirty pages, resulting in blocks never being zeroed on disk. After changes to buffer invalidation behavior, pages end up with clean PageDirty bits but dirty buffers attached. When a file is converted from inline format and later grown, the invalid dirtiness state persists, causing written data to be lost when pages are reclaimed (Kernel Git).

When exploited, this vulnerability can lead to data corruption and loss of file contents. Specifically, when a file is converted from inline format, undergoes writeback, and is subsequently grown, data written to affected pages is permanently lost once those pages are reclaimed from memory (Kernel Git).

The issue can be reproduced using standard filesystem operations. A proof-of-concept exists using the xfs_io utility with a sequence of write operations: xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" -c "pwrite 4000 2000" ocfs2_file. After unmounting and remounting the filesystem, the end portion of the file loses its contents (Kernel Git).

The vulnerability was fixed by removing the unnecessary zeroing during conversion from inline format, similar to the approach taken in the standard write path. The fix was implemented in the Linux kernel and backported to affected stable versions (Kernel Git).