* Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors [not found] <2024110851-CVE-2024-50191-f31c@gregkh> @ 2024-12-30 7:27 ` Baokun Li 2024-12-30 7:54 ` Greg KH 0 siblings, 1 reply; 5+ messages in thread From: Baokun Li @ 2024-12-30 7:27 UTC (permalink / raw) To: gregkh Cc: cve, linux-cve-announce, linux-kernel, Jan Kara, Theodore Ts'o, linux-ext4@vger.kernel.org, Yang Erkun > Description > =========== > > In the Linux kernel, the following vulnerability has been resolved: > > ext4: don't set SB_RDONLY after filesystem errors > > When the filesystem is mounted with errors=remount-ro, we were setting > SB_RDONLY flag to stop all filesystem modifications. We knew this misses > proper locking (sb->s_umount) and does not go through proper filesystem > remount procedure but it has been the way this worked since early ext2 > days and it was good enough for catastrophic situation damage > mitigation. Recently, syzbot has found a way (see link) to trigger > warnings in filesystem freezing because the code got confused by > SB_RDONLY changing under its hands. Since these days we set > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So > stop doing that. > > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue. > > > Affected and fixed versions > =========================== > > Fixed in 5.15.168 with commit fbb177bc1d64 > Fixed in 6.1.113 with commit 4061e07f040a Since 6.1 and 5.15 don't have backport commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"), we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So here these two commits cause us to repeatedly get the following printout: [ 42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal has aborted [ 42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fsstress: Detected aborted journal [ 42.999893] EXT4-fs: 58002 callbacks suppressed [ 42.999895] EXT4-fs (sda): Remounting filesystem read-only [ 43.000110] EXT4-fs (sda): Remounting filesystem read-only [ 43.000274] EXT4-fs (sda): Remounting filesystem read-only [ 43.000421] EXT4-fs (sda): Remounting filesystem read-only [ 43.000569] EXT4-fs (sda): Remounting filesystem read-only [ 43.000701] EXT4-fs (sda): Remounting filesystem read-only [ 43.000869] EXT4-fs (sda): Remounting filesystem read-only [ 43.001094] EXT4-fs (sda): Remounting filesystem read-only [ 43.001229] EXT4-fs (sda): Remounting filesystem read-only [ 43.001365] EXT4-fs (sda): Remounting filesystem read-only Perhaps we should revert both commits. Thanks, Baokun > Fixed in 6.6.57 with commit 58c0648e4c77 > Fixed in 6.11.4 with commit ee77c3884691 > Fixed in 6.12-rc1 with commit d3476f3dad4a > > Please see https://www.kernel.org for a full list of currently supported > kernel versions by the kernel community. > > Unaffected versions might change over time as fixes are backported to > older supported kernel versions. The official CVE entry at > https://cve.org/CVERecord/?id=CVE-2024-50191 > will be updated if fixes are backported, please check that for the most > up to date information about this issue. > > > Affected files > ============== > > The file(s) affected by this issue are: > fs/ext4/super.c > > > Mitigation > ========== > > The Linux kernel CVE team recommends that you update to the latest > stable kernel version for this, and many other bugfixes. Individual > changes are never tested alone, but rather are part of a larger kernel > release. Cherry-picking individual commits is not recommended or > supported by the Linux kernel community at all. If however, updating to > the latest release is impossible, the individual changes to resolve this > issue can be found at these commits: > https://git.kernel.org/stable/c/fbb177bc1d6487cd3e9b50ae0be2781b7297980d > https://git.kernel.org/stable/c/4061e07f040a091f694f461b86a26cf95ae66439 > https://git.kernel.org/stable/c/58c0648e4c773f5b54f0cb63bc8c7c6bf52719a9 > https://git.kernel.org/stable/c/ee77c388469116565e009eaa704a60bc78489e09 > https://git.kernel.org/stable/c/d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors 2024-12-30 7:27 ` CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors Baokun Li @ 2024-12-30 7:54 ` Greg KH 2024-12-30 8:21 ` Baokun Li 0 siblings, 1 reply; 5+ messages in thread From: Greg KH @ 2024-12-30 7:54 UTC (permalink / raw) To: Baokun Li Cc: cve, linux-cve-announce, linux-kernel, Jan Kara, Theodore Ts'o, linux-ext4@vger.kernel.org, Yang Erkun On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote: > > Description > > =========== > > > > In the Linux kernel, the following vulnerability has been resolved: > > > > ext4: don't set SB_RDONLY after filesystem errors > > > > When the filesystem is mounted with errors=remount-ro, we were setting > > SB_RDONLY flag to stop all filesystem modifications. We knew this misses > > proper locking (sb->s_umount) and does not go through proper filesystem > > remount procedure but it has been the way this worked since early ext2 > > days and it was good enough for catastrophic situation damage > > mitigation. Recently, syzbot has found a way (see link) to trigger > > warnings in filesystem freezing because the code got confused by > > SB_RDONLY changing under its hands. Since these days we set > > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all > > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So > > stop doing that. > > > > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue. > > > > > > Affected and fixed versions > > =========================== > > > > Fixed in 5.15.168 with commit fbb177bc1d64 > > Fixed in 6.1.113 with commit 4061e07f040a > > Since 6.1 and 5.15 don't have backport > commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"), > we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So > here these two commits cause us to repeatedly get the following printout: > > [ 42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal > has aborted > [ 42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > fsstress: Detected aborted journal > [ 42.999893] EXT4-fs: 58002 callbacks suppressed > [ 42.999895] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000110] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000274] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000421] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000569] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000701] EXT4-fs (sda): Remounting filesystem read-only > [ 43.000869] EXT4-fs (sda): Remounting filesystem read-only > [ 43.001094] EXT4-fs (sda): Remounting filesystem read-only > [ 43.001229] EXT4-fs (sda): Remounting filesystem read-only > [ 43.001365] EXT4-fs (sda): Remounting filesystem read-only > > Perhaps we should revert both commits. Maybe, if so, please send the needed info to the stable list with the backports that have been tested. cve@kernel.org isn't the place for this :) thanks, greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors 2024-12-30 7:54 ` Greg KH @ 2024-12-30 8:21 ` Baokun Li 2024-12-30 8:33 ` Greg KH 0 siblings, 1 reply; 5+ messages in thread From: Baokun Li @ 2024-12-30 8:21 UTC (permalink / raw) To: Greg KH Cc: linux-cve-announce, linux-kernel, Jan Kara, Theodore Ts'o, linux-ext4@vger.kernel.org, Yang Erkun On 2024/12/30 15:54, Greg KH wrote: > On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote: >>> Description >>> =========== >>> >>> In the Linux kernel, the following vulnerability has been resolved: >>> >>> ext4: don't set SB_RDONLY after filesystem errors >>> >>> When the filesystem is mounted with errors=remount-ro, we were setting >>> SB_RDONLY flag to stop all filesystem modifications. We knew this misses >>> proper locking (sb->s_umount) and does not go through proper filesystem >>> remount procedure but it has been the way this worked since early ext2 >>> days and it was good enough for catastrophic situation damage >>> mitigation. Recently, syzbot has found a way (see link) to trigger >>> warnings in filesystem freezing because the code got confused by >>> SB_RDONLY changing under its hands. Since these days we set >>> EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all >>> filesystem modifications, modifying SB_RDONLY shouldn't be needed. So >>> stop doing that. >>> >>> The Linux kernel CVE team has assigned CVE-2024-50191 to this issue. >>> >>> >>> Affected and fixed versions >>> =========================== >>> >>> Fixed in 5.15.168 with commit fbb177bc1d64 >>> Fixed in 6.1.113 with commit 4061e07f040a >> Since 6.1 and 5.15 don't have backport >> commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"), >> we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So >> here these two commits cause us to repeatedly get the following printout: >> >> [ 42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal >> has aborted >> [ 42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >> fsstress: Detected aborted journal >> [ 42.999893] EXT4-fs: 58002 callbacks suppressed >> [ 42.999895] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000110] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000274] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000421] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000569] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000701] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.000869] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.001094] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.001229] EXT4-fs (sda): Remounting filesystem read-only >> [ 43.001365] EXT4-fs (sda): Remounting filesystem read-only >> >> Perhaps we should revert both commits. > Maybe, if so, please send the needed info to the stable list with the > backports that have been tested. cve@kernel.org isn't the place for > this :) I replied to this thread on lore, which automatically CC's cve@kernel.org. We don't use these two versions, we just happened to find the issue. If you feel that reporting issue is bothering you, then I won't do it.🙂 Regards, Baokun ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors 2024-12-30 8:21 ` Baokun Li @ 2024-12-30 8:33 ` Greg KH 2024-12-30 9:06 ` Baokun Li 0 siblings, 1 reply; 5+ messages in thread From: Greg KH @ 2024-12-30 8:33 UTC (permalink / raw) To: Baokun Li Cc: linux-cve-announce, linux-kernel, Jan Kara, Theodore Ts'o, linux-ext4@vger.kernel.org, Yang Erkun On Mon, Dec 30, 2024 at 04:21:00PM +0800, Baokun Li wrote: > On 2024/12/30 15:54, Greg KH wrote: > > On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote: > > > > Description > > > > =========== > > > > > > > > In the Linux kernel, the following vulnerability has been resolved: > > > > > > > > ext4: don't set SB_RDONLY after filesystem errors > > > > > > > > When the filesystem is mounted with errors=remount-ro, we were setting > > > > SB_RDONLY flag to stop all filesystem modifications. We knew this misses > > > > proper locking (sb->s_umount) and does not go through proper filesystem > > > > remount procedure but it has been the way this worked since early ext2 > > > > days and it was good enough for catastrophic situation damage > > > > mitigation. Recently, syzbot has found a way (see link) to trigger > > > > warnings in filesystem freezing because the code got confused by > > > > SB_RDONLY changing under its hands. Since these days we set > > > > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all > > > > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So > > > > stop doing that. > > > > > > > > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue. > > > > > > > > > > > > Affected and fixed versions > > > > =========================== > > > > > > > > Fixed in 5.15.168 with commit fbb177bc1d64 > > > > Fixed in 6.1.113 with commit 4061e07f040a > > > Since 6.1 and 5.15 don't have backport > > > commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"), > > > we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So > > > here these two commits cause us to repeatedly get the following printout: > > > > > > [ 42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal > > > has aborted > > > [ 42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm > > > fsstress: Detected aborted journal > > > [ 42.999893] EXT4-fs: 58002 callbacks suppressed > > > [ 42.999895] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000110] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000274] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000421] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000569] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000701] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.000869] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.001094] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.001229] EXT4-fs (sda): Remounting filesystem read-only > > > [ 43.001365] EXT4-fs (sda): Remounting filesystem read-only > > > > > > Perhaps we should revert both commits. > > Maybe, if so, please send the needed info to the stable list with the > > backports that have been tested. cve@kernel.org isn't the place for > > this :) > > I replied to this thread on lore, which automatically CC's cve@kernel.org. Yes, which is fine, but you are responding to a CVE report, NOT to a stable kernel patch that has been backported, which is what I think you want to respond to, right? > We don't use these two versions, we just happened to find the issue. > If you feel that reporting issue is bothering you, then I won't do it.🙂 It's fine, I'm just trying to get you to route it to a group of people that can do something about it. Again, try responding to the stable patch that was merged there, that would be better, along with perhaps providing a patch showing what you feel should be done. If patches that are assigned CVEs later get reverted, the CVEs should semi-automatically be rejected (I swept the CVE tree for this last week), so you don't need to worry about that happening. thanks, greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors 2024-12-30 8:33 ` Greg KH @ 2024-12-30 9:06 ` Baokun Li 0 siblings, 0 replies; 5+ messages in thread From: Baokun Li @ 2024-12-30 9:06 UTC (permalink / raw) To: Greg KH Cc: linux-cve-announce, linux-kernel, Jan Kara, Theodore Ts'o, linux-ext4@vger.kernel.org, Yang Erkun On 2024/12/30 16:33, Greg KH wrote: > On Mon, Dec 30, 2024 at 04:21:00PM +0800, Baokun Li wrote: >> On 2024/12/30 15:54, Greg KH wrote: >>> On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote: >>>>> Description >>>>> =========== >>>>> >>>>> In the Linux kernel, the following vulnerability has been resolved: >>>>> >>>>> ext4: don't set SB_RDONLY after filesystem errors >>>>> >>>>> When the filesystem is mounted with errors=remount-ro, we were setting >>>>> SB_RDONLY flag to stop all filesystem modifications. We knew this misses >>>>> proper locking (sb->s_umount) and does not go through proper filesystem >>>>> remount procedure but it has been the way this worked since early ext2 >>>>> days and it was good enough for catastrophic situation damage >>>>> mitigation. Recently, syzbot has found a way (see link) to trigger >>>>> warnings in filesystem freezing because the code got confused by >>>>> SB_RDONLY changing under its hands. Since these days we set >>>>> EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all >>>>> filesystem modifications, modifying SB_RDONLY shouldn't be needed. So >>>>> stop doing that. >>>>> >>>>> The Linux kernel CVE team has assigned CVE-2024-50191 to this issue. >>>>> >>>>> >>>>> Affected and fixed versions >>>>> =========================== >>>>> >>>>> Fixed in 5.15.168 with commit fbb177bc1d64 >>>>> Fixed in 6.1.113 with commit 4061e07f040a >>>> Since 6.1 and 5.15 don't have backport >>>> commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"), >>>> we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So >>>> here these two commits cause us to repeatedly get the following printout: >>>> >>>> [ 42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal >>>> has aborted >>>> [ 42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm >>>> fsstress: Detected aborted journal >>>> [ 42.999893] EXT4-fs: 58002 callbacks suppressed >>>> [ 42.999895] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000110] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000274] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000421] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000569] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000701] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.000869] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.001094] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.001229] EXT4-fs (sda): Remounting filesystem read-only >>>> [ 43.001365] EXT4-fs (sda): Remounting filesystem read-only >>>> >>>> Perhaps we should revert both commits. >>> Maybe, if so, please send the needed info to the stable list with the >>> backports that have been tested. cve@kernel.org isn't the place for >>> this :) >> I replied to this thread on lore, which automatically CC's cve@kernel.org. > Yes, which is fine, but you are responding to a CVE report, NOT to a > stable kernel patch that has been backported, which is what I think you > want to respond to, right? Actually, we discovered the mechanism change introduced by its fix patch while analyzing CVE-2024-50191. https://lore.kernel.org/linux-ext4/22d652f6-cb3c-43f5-b2fe-0a4bb6516a04@huawei.com/T/#u However, the situation is worse for 5.15 and 6.1, as the patch upon which the fix depends has not even been merged yet. Therefore, I am replying here to prevent the erroneous information from further propagating with the CVE. > >> We don't use these two versions, we just happened to find the issue. >> If you feel that reporting issue is bothering you, then I won't do it.🙂 > It's fine, I'm just trying to get you to route it to a group of people > that can do something about it. Again, try responding to the stable > patch that was merged there, that would be better, along with perhaps > providing a patch showing what you feel should be done. The problem I've reported to the ext4 mail list, and perhaps some patches will be synchronized to stable if anything comes of the discussion in the link above. > If patches that are assigned CVEs later get reverted, the CVEs should > semi-automatically be rejected (I swept the CVE tree for this last > week), so you don't need to worry about that happening. > Thank you for your maintenance! This CVE is indeed a problem, so it's not necessary to reject it. What I can say for sure now is that the 5.15 and 6.1 fixes are problematic. The final solution needs some more discussion. Regards, Baokun ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-12-30 9:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <2024110851-CVE-2024-50191-f31c@gregkh>
2024-12-30 7:27 ` CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors Baokun Li
2024-12-30 7:54 ` Greg KH
2024-12-30 8:21 ` Baokun Li
2024-12-30 8:33 ` Greg KH
2024-12-30 9:06 ` Baokun Li
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox