From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB646216600 for ; Wed, 26 Feb 2025 02:14:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536043; cv=none; b=Lit8Ub4UWNP8QfKTcUoVMLLYq37IvUUrsM2wZGWBkIGlhaXbbc4/uq3dbGt2dam/GpafCMZ8mKGprtrsio2StFX8GbpZMGUia6sqwAOOSTxBXT9P1ZZicdvMBPMqIQ6vdqZebTwuP2wgC1EyVt1Nqhqb+kH+2kU6jGdDOEF5W5E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536043; c=relaxed/simple; bh=7czCN4DIm8trKts6/mMXkKGD62CMdV0d8nCNcrxU8jE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pdIqzRjm+lOHI3favpReh7xZq6WFMdAa19qPobIbogEjc309It/xYWTW/Dl3qKhSv4md0PAjS8AWN3tROP7xW4vXOaVBt+xcLn/WxS286rtfzKudA4LQdbZoXb3h0Ck9Saodzhbcm5MJrz0Y6eveAKhG7DUiH7OwzosXXBl0OlQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JF6yrX9/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JF6yrX9/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2031C4CEDD; Wed, 26 Feb 2025 02:14:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536043; bh=7czCN4DIm8trKts6/mMXkKGD62CMdV0d8nCNcrxU8jE=; h=From:To:Cc:Subject:Date:Reply-to:From; b=JF6yrX9/54ZXEwftbVaJ2Sr68UAKxGCwIeLmkmloCYM96eccAOGwTv0osxvOus0lL pKNev2raYaGI6Y9ER03Y+uWedfv8H2p+tGFE75opvcI42syrzu0y4d1pwasxTi35aM 06K6X4lshc3djBOgBwY101VkuVsFDtUe5bSK1l2c= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49414: ext4: fix race condition between ext4_write and ext4_convert_inline_data Date: Wed, 26 Feb 2025 03:11:28 +0100 Message-ID: <2025022653-CVE-2022-49414-5693@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5756; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=7czCN4DIm8trKts6/mMXkKGD62CMdV0d8nCNcrxU8jE=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yj+evWarJmXz3+SAZfoyXj2Z6RpThF/s3DtVc89Gr 9NTtCpVO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiolIMCy69bK69bcvGlSG0 sFh/iveisMu18gwLpvE7/2S5fvXpjj0nrwd/fpfY+OSuAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4_write and ext4_convert_inline_data Hulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace: ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). The Linux kernel CVE team has assigned CVE-2022-49414 to this issue. Affected and fixed versions =========================== Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.4.207 with commit 18881d7e517169193d9ef6c89c7f322e3e164277 Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.10.132 with commit 91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.15.46 with commit 14602353b350950b551eccc6b46411aa3b12ffe2 Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.17.14 with commit 725e00cb7039eae291890f1bb19bc867176745f6 Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.18.3 with commit ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 Issue introduced in 3.8 with commit 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf and fixed in 5.19 with commit f87c7a4b084afc13190cbb263538e444cb2b392a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49414 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ext4/extents.c fs/ext4/inode.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277 https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2 https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6 https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a