From: Eric Biggers <ebiggers@kernel.org>
To: Joshua Abata <joshabata@gmail.com>
Cc: linux-ext4@vger.kernel.org, linux-fscrypt@vger.kernel.org,
tytso@mit.edu, adilger.kernel@dilger.ca
Subject: Re: [BUG] ext4/fscrypt: memory corruption after enabling "encrypt" on a mounted fs (large folios + bounce page), 7.0
Date: Sun, 25 Oct 2026 16:50:54 -0700 [thread overview]
Message-ID: <20261025235054.GD148998@quark> (raw)
In-Reply-To: <CAJoS2iZ6kKLDqs0cib2=aXn5WMXH2HmK3D+KZaVBN0mXiv4yQA@mail.gmail.com>
On Sun, Oct 25, 2026 at 04:41:16PM -0700, Joshua Abata wrote:
> Hi,
>
> Enabling the ext4 "encrypt" feature with tune2fs on a *mounted* filesystem
> and then writing through an fscrypt v2
> policy corrupts kernel memory on 7.0 (Ubuntu 7.0.0-38-generic). It
> reproduces in seconds on an untainted kernel in a
> plain QEMU VM; the same steps with an unmount/remount after tune2fs are
> fine.
>
> Reproducer (as root, any 7.0 x86_64 with ext4 large folios):
7.0 is no longer a supported kernel version upstream. It was not chosen
as an LTS kernel, and the last 7.0.y stable release occurred on June 27
with Linux v7.0.14.
This sounds like the bug that was already fixed in 7.2 by
"ext4: don't enable large folios on encrypted inodes"
(https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-7.2.y&id=40554d1221e3d2ff2e0d192b74a05d89eb3620e7) and in 7.3 by other changes.
If Ubuntu is using an unsupported kernel version that is missing this
fix, then you would need to report that to Ubuntu.
- Eric
parent reply other threads:[~2026-10-25 23:50 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <CAJoS2iZ6kKLDqs0cib2=aXn5WMXH2HmK3D+KZaVBN0mXiv4yQA@mail.gmail.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261025235054.GD148998@quark \
--to=ebiggers@kernel.org \
--cc=adilger.kernel@dilger.ca \
--cc=joshabata@gmail.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox