From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D3B42163AF for ; Wed, 26 Feb 2025 02:14:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536040; cv=none; b=VYq1L7+Mivc5plA690zON5VByzq8ndXbpX4ETjgZH3MbX8hxEysV7sbgVKexULtrppSwghFm6495TUBm0RfgXaIdnkhatzU2+Mqs110VDsM4pnu7FYy30t+ijuZkgA2W3j1iKRF/AottSKJ+vHEGofcKk3zaUkob8UvQP5aZjgE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536040; c=relaxed/simple; bh=LXl+YrnUK8IaBep0qeJayAHyM18ZMgJiA4hqq1N6K38=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bQ/caIekknibWyqziD4fjSswcv0dKfRaj5SgjzKRCTlkNWpXt9grVJTMrvmfG4rl1xLxdhPOfmcSq9FBFrgWS+eOUAlaMfSUlCOBcKlKVQixG6HLRx8iuIoZU9iFsbQ6GRmJRmmbiaRS2ih1/dNhsH7vZVjLYoW7KB3MQdXOMgs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Qz9xTUYb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Qz9xTUYb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31C9EC4CEE6; Wed, 26 Feb 2025 02:14:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536040; bh=LXl+YrnUK8IaBep0qeJayAHyM18ZMgJiA4hqq1N6K38=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Qz9xTUYbMK10HbtLCCDh0H12LAPt2NLavMfC9Td2eLdnIZ3D2mCmNkbeRt6VnEGaj 4XtROqvtbKfHU400bRIxGcjQS40BhNAiDYwQm4AgqiUmKE5/yOdl5qFIMN02aVgbm8 C+DlloU+tSTz281bPlXNg5uYUqqqgDEunsTGBpYQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49409: ext4: fix bug_on in __es_tree_search Date: Wed, 26 Feb 2025 03:11:23 +0100 Message-ID: <2025022652-CVE-2022-49409-b4e3@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5874; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=LXl+YrnUK8IaBep0qeJayAHyM18ZMgJiA4hqq1N6K38=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yj9Mdtz1bVp0xaHEne9i4p957cg49dzgtUSoimNjS vPTQxX/OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAi6Z0M87O+VttZPni3tc1J 7fmWY8pqMXP18xkWXLPlPpLk6tsW6rZ/7v+l31dvrxBjBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567 ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980 ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031 ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257 v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63 v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82 vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368 dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490 ext4_quota_enable fs/ext4/super.c:6137 [inline] ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163 ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754 mount_bdev+0x2e9/0x3b0 fs/super.c:1158 mount_fs+0x4b/0x1e4 fs/super.c:1261 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_enable_quotas ext4_quota_enable ext4_iget __ext4_iget ext4_ext_check_inode ext4_ext_check __ext4_ext_check ext4_valid_extent_entries Check for overlapping extents does't take effect dquot_enable vfs_load_quota_inode v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent ext4_es_cache_extent __es_tree_search ext4_es_end BUG_ON(es->es_lblk + es->es_len < es->es_lblk) The error ext4 extents is as follows: 0af3 0300 0400 0000 00000000 extent_header 00000000 0100 0000 12000000 extent1 00000000 0100 0000 18000000 extent2 02000000 0400 0000 14000000 extent3 In the ext4_valid_extent_entries function, if prev is 0, no error is returned even if lblock<=prev. This was intended to skip the check on the first extent, but in the error image above, prev=0+1-1=0 when checking the second extent, so even though lblock<=prev, the function does not return an error. As a result, bug_ON occurs in __es_tree_search and the system panics. To solve this problem, we only need to check that: 1. The lblock of the first extent is not less than 0. 2. The lblock of the next extent is not less than the next block of the previous extent. The same applies to extent_idx. The Linux kernel CVE team has assigned CVE-2022-49409 to this issue. Affected and fixed versions =========================== Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.4.277 with commit d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.10.121 with commit 4fd58b5cf118d2d9038a0b8c9cc0e43096297686 Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.15.46 with commit 3c617827cd51018bc377bd2954e176920ddbcfad Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.17.14 with commit 59cf2fabbfe76de29d88dd7ae69858a25735b59f Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.18.3 with commit ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a Issue introduced in 3.13 with commit 5946d089379a35dda0e531710b48fca05446a196 and fixed in 5.19 with commit d36f6ed761b53933b0b4126486c10d3da7751e7f Issue introduced in 3.2.55 with commit 4645e4ee32aee01a85bdc03348982a65c65ce216 Issue introduced in 3.4.76 with commit a1192c0e5d037def6763f3873d3340615c241fe7 Issue introduced in 3.10.26 with commit ae21dda05193c441bde106a4bbf88c185a68fbed Issue introduced in 3.12.7 with commit ea214c946ee77588c4313be3e9951edd25d6b270 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49409 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ext4/extents.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f https://git.kernel.org/stable/c/4fd58b5cf118d2d9038a0b8c9cc0e43096297686 https://git.kernel.org/stable/c/3c617827cd51018bc377bd2954e176920ddbcfad https://git.kernel.org/stable/c/59cf2fabbfe76de29d88dd7ae69858a25735b59f https://git.kernel.org/stable/c/ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a https://git.kernel.org/stable/c/d36f6ed761b53933b0b4126486c10d3da7751e7f