Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Baokun Li]

> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ext4: don't set SB_RDONLY after filesystem errors
>
> When the filesystem is mounted with errors=remount-ro, we were setting
> SB_RDONLY flag to stop all filesystem modifications. We knew this misses
> proper locking (sb->s_umount) and does not go through proper filesystem
> remount procedure but it has been the way this worked since early ext2
> days and it was good enough for catastrophic situation damage
> mitigation. Recently, syzbot has found a way (see link) to trigger
> warnings in filesystem freezing because the code got confused by
> SB_RDONLY changing under its hands. Since these days we set
> EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
> filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
> stop doing that.
>
> The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
>
>
> Affected and fixed versions
> ===========================
>
>     Fixed in 5.15.168 with commit fbb177bc1d64
>     Fixed in 6.1.113 with commit 4061e07f040a

Since 6.1 and 5.15 don't have backport
     commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
here these two commits cause us to repeatedly get the following printout:

[   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: 
Journal has aborted
[   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: 
comm fsstress: Detected aborted journal
[   42.999893] EXT4-fs: 58002 callbacks suppressed
[   42.999895] EXT4-fs (sda): Remounting filesystem read-only
[   43.000110] EXT4-fs (sda): Remounting filesystem read-only
[   43.000274] EXT4-fs (sda): Remounting filesystem read-only
[   43.000421] EXT4-fs (sda): Remounting filesystem read-only
[   43.000569] EXT4-fs (sda): Remounting filesystem read-only
[   43.000701] EXT4-fs (sda): Remounting filesystem read-only
[   43.000869] EXT4-fs (sda): Remounting filesystem read-only
[   43.001094] EXT4-fs (sda): Remounting filesystem read-only
[   43.001229] EXT4-fs (sda): Remounting filesystem read-only
[   43.001365] EXT4-fs (sda): Remounting filesystem read-only

Perhaps we should revert both commits.


Thanks,
Baokun

>     Fixed in 6.6.57 with commit 58c0648e4c77
>     Fixed in 6.11.4 with commit ee77c3884691
>     Fixed in 6.12-rc1 with commit d3476f3dad4a
>
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
>
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> https://cve.org/CVERecord/?id=CVE-2024-50191
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
>
>
> Affected files
> ==============
>
> The file(s) affected by this issue are:
>     fs/ext4/super.c
>
>
> Mitigation
> ==========
>
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes. Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> https://git.kernel.org/stable/c/fbb177bc1d6487cd3e9b50ae0be2781b7297980d
> https://git.kernel.org/stable/c/4061e07f040a091f694f461b86a26cf95ae66439
> https://git.kernel.org/stable/c/58c0648e4c773f5b54f0cb63bc8c7c6bf52719a9
> https://git.kernel.org/stable/c/ee77c388469116565e009eaa704a60bc78489e09
> https://git.kernel.org/stable/c/d3476f3dad4ad68ae5f6b008ea6591d1520da5d8

Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Greg KH]

On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > ext4: don't set SB_RDONLY after filesystem errors
> > 
> > When the filesystem is mounted with errors=remount-ro, we were setting
> > SB_RDONLY flag to stop all filesystem modifications. We knew this misses
> > proper locking (sb->s_umount) and does not go through proper filesystem
> > remount procedure but it has been the way this worked since early ext2
> > days and it was good enough for catastrophic situation damage
> > mitigation. Recently, syzbot has found a way (see link) to trigger
> > warnings in filesystem freezing because the code got confused by
> > SB_RDONLY changing under its hands. Since these days we set
> > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
> > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
> > stop doing that.
> > 
> > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
> > 
> > 
> > Affected and fixed versions
> > ===========================
> > 
> >     Fixed in 5.15.168 with commit fbb177bc1d64
> >     Fixed in 6.1.113 with commit 4061e07f040a
> 
> Since 6.1 and 5.15 don't have backport
>     commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
> we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
> here these two commits cause us to repeatedly get the following printout:
> 
> [   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal
> has aborted
> [   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> fsstress: Detected aborted journal
> [   42.999893] EXT4-fs: 58002 callbacks suppressed
> [   42.999895] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000110] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000274] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000421] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000569] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000701] EXT4-fs (sda): Remounting filesystem read-only
> [   43.000869] EXT4-fs (sda): Remounting filesystem read-only
> [   43.001094] EXT4-fs (sda): Remounting filesystem read-only
> [   43.001229] EXT4-fs (sda): Remounting filesystem read-only
> [   43.001365] EXT4-fs (sda): Remounting filesystem read-only
> 
> Perhaps we should revert both commits.

Maybe, if so, please send the needed info to the stable list with the
backports that have been tested.  cve@kernel.org isn't the place for
this :)

thanks,

greg k-h

Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Baokun Li]

On 2024/12/30 15:54, Greg KH wrote:
> On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote:
>>> Description
>>> ===========
>>>
>>> In the Linux kernel, the following vulnerability has been resolved:
>>>
>>> ext4: don't set SB_RDONLY after filesystem errors
>>>
>>> When the filesystem is mounted with errors=remount-ro, we were setting
>>> SB_RDONLY flag to stop all filesystem modifications. We knew this misses
>>> proper locking (sb->s_umount) and does not go through proper filesystem
>>> remount procedure but it has been the way this worked since early ext2
>>> days and it was good enough for catastrophic situation damage
>>> mitigation. Recently, syzbot has found a way (see link) to trigger
>>> warnings in filesystem freezing because the code got confused by
>>> SB_RDONLY changing under its hands. Since these days we set
>>> EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
>>> filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
>>> stop doing that.
>>>
>>> The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
>>>
>>>
>>> Affected and fixed versions
>>> ===========================
>>>
>>>      Fixed in 5.15.168 with commit fbb177bc1d64
>>>      Fixed in 6.1.113 with commit 4061e07f040a
>> Since 6.1 and 5.15 don't have backport
>>      commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
>> we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
>> here these two commits cause us to repeatedly get the following printout:
>>
>> [   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal
>> has aborted
>> [   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>> fsstress: Detected aborted journal
>> [   42.999893] EXT4-fs: 58002 callbacks suppressed
>> [   42.999895] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000110] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000274] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000421] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000569] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000701] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.000869] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.001094] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.001229] EXT4-fs (sda): Remounting filesystem read-only
>> [   43.001365] EXT4-fs (sda): Remounting filesystem read-only
>>
>> Perhaps we should revert both commits.
> Maybe, if so, please send the needed info to the stable list with the
> backports that have been tested.  cve@kernel.org isn't the place for
> this :)

I replied to this thread on lore, which automatically CC's cve@kernel.org.

We don't use these two versions, we just happened to find the issue.
If you feel that reporting issue is bothering you, then I won't do it.🙂


Regards,
Baokun

Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Greg KH]

On Mon, Dec 30, 2024 at 04:21:00PM +0800, Baokun Li wrote:
> On 2024/12/30 15:54, Greg KH wrote:
> > On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote:
> > > > Description
> > > > ===========
> > > > 
> > > > In the Linux kernel, the following vulnerability has been resolved:
> > > > 
> > > > ext4: don't set SB_RDONLY after filesystem errors
> > > > 
> > > > When the filesystem is mounted with errors=remount-ro, we were setting
> > > > SB_RDONLY flag to stop all filesystem modifications. We knew this misses
> > > > proper locking (sb->s_umount) and does not go through proper filesystem
> > > > remount procedure but it has been the way this worked since early ext2
> > > > days and it was good enough for catastrophic situation damage
> > > > mitigation. Recently, syzbot has found a way (see link) to trigger
> > > > warnings in filesystem freezing because the code got confused by
> > > > SB_RDONLY changing under its hands. Since these days we set
> > > > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
> > > > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
> > > > stop doing that.
> > > > 
> > > > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
> > > > 
> > > > 
> > > > Affected and fixed versions
> > > > ===========================
> > > > 
> > > >      Fixed in 5.15.168 with commit fbb177bc1d64
> > > >      Fixed in 6.1.113 with commit 4061e07f040a
> > > Since 6.1 and 5.15 don't have backport
> > >      commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
> > > we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
> > > here these two commits cause us to repeatedly get the following printout:
> > > 
> > > [   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal
> > > has aborted
> > > [   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > fsstress: Detected aborted journal
> > > [   42.999893] EXT4-fs: 58002 callbacks suppressed
> > > [   42.999895] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000110] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000274] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000421] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000569] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000701] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.000869] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.001094] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.001229] EXT4-fs (sda): Remounting filesystem read-only
> > > [   43.001365] EXT4-fs (sda): Remounting filesystem read-only
> > > 
> > > Perhaps we should revert both commits.
> > Maybe, if so, please send the needed info to the stable list with the
> > backports that have been tested.  cve@kernel.org isn't the place for
> > this :)
> 
> I replied to this thread on lore, which automatically CC's cve@kernel.org.

Yes, which is fine, but you are responding to a CVE report, NOT to a
stable kernel patch that has been backported, which is what I think you
want to respond to, right?

> We don't use these two versions, we just happened to find the issue.
> If you feel that reporting issue is bothering you, then I won't do it.🙂

It's fine, I'm just trying to get you to route it to a group of people
that can do something about it.  Again, try responding to the stable
patch that was merged there, that would be better, along with perhaps
providing a patch showing what you feel should be done.

If patches that are assigned CVEs later get reverted, the CVEs should
semi-automatically be rejected (I swept the CVE tree for this last
week), so you don't need to worry about that happening.

thanks,

greg k-h

Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Baokun Li]

On 2024/12/30 16:33, Greg KH wrote:
> On Mon, Dec 30, 2024 at 04:21:00PM +0800, Baokun Li wrote:
>> On 2024/12/30 15:54, Greg KH wrote:
>>> On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote:
>>>>> Description
>>>>> ===========
>>>>>
>>>>> In the Linux kernel, the following vulnerability has been resolved:
>>>>>
>>>>> ext4: don't set SB_RDONLY after filesystem errors
>>>>>
>>>>> When the filesystem is mounted with errors=remount-ro, we were setting
>>>>> SB_RDONLY flag to stop all filesystem modifications. We knew this misses
>>>>> proper locking (sb->s_umount) and does not go through proper filesystem
>>>>> remount procedure but it has been the way this worked since early ext2
>>>>> days and it was good enough for catastrophic situation damage
>>>>> mitigation. Recently, syzbot has found a way (see link) to trigger
>>>>> warnings in filesystem freezing because the code got confused by
>>>>> SB_RDONLY changing under its hands. Since these days we set
>>>>> EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
>>>>> filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
>>>>> stop doing that.
>>>>>
>>>>> The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
>>>>>
>>>>>
>>>>> Affected and fixed versions
>>>>> ===========================
>>>>>
>>>>>       Fixed in 5.15.168 with commit fbb177bc1d64
>>>>>       Fixed in 6.1.113 with commit 4061e07f040a
>>>> Since 6.1 and 5.15 don't have backport
>>>>       commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
>>>> we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
>>>> here these two commits cause us to repeatedly get the following printout:
>>>>
>>>> [   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal
>>>> has aborted
>>>> [   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
>>>> fsstress: Detected aborted journal
>>>> [   42.999893] EXT4-fs: 58002 callbacks suppressed
>>>> [   42.999895] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000110] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000274] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000421] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000569] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000701] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.000869] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.001094] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.001229] EXT4-fs (sda): Remounting filesystem read-only
>>>> [   43.001365] EXT4-fs (sda): Remounting filesystem read-only
>>>>
>>>> Perhaps we should revert both commits.
>>> Maybe, if so, please send the needed info to the stable list with the
>>> backports that have been tested.  cve@kernel.org isn't the place for
>>> this :)
>> I replied to this thread on lore, which automatically CC's cve@kernel.org.
> Yes, which is fine, but you are responding to a CVE report, NOT to a
> stable kernel patch that has been backported, which is what I think you
> want to respond to, right?
Actually, we discovered the mechanism change introduced by its fix patch
while analyzing CVE-2024-50191.
https://lore.kernel.org/linux-ext4/22d652f6-cb3c-43f5-b2fe-0a4bb6516a04@huawei.com/T/#u

However, the situation is worse for 5.15 and 6.1, as the patch upon which
the fix depends has not even been merged yet. Therefore, I am replying here
to prevent the erroneous information from further propagating with the CVE.
>
>> We don't use these two versions, we just happened to find the issue.
>> If you feel that reporting issue is bothering you, then I won't do it.🙂
> It's fine, I'm just trying to get you to route it to a group of people
> that can do something about it.  Again, try responding to the stable
> patch that was merged there, that would be better, along with perhaps
> providing a patch showing what you feel should be done.
The problem I've reported to the ext4 mail list, and perhaps some patches
will be synchronized to stable if anything comes of the discussion in the
link above.
> If patches that are assigned CVEs later get reverted, the CVEs should
> semi-automatically be rejected (I swept the CVE tree for this last
> week), so you don't need to worry about that happening.
>
Thank you for your maintenance!

This CVE is indeed a problem, so it's not necessary to reject it.
What I can say for sure now is that the 5.15 and 6.1 fixes are problematic.
The final solution needs some more discussion.


Regards,
Baokun