linux-cve-announce - CVE-2022-49347: ext4: fix bug_on in ext4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025022642-CVE-2022-49347-6ba6@gregkh>
Date: Wed, 26 Feb 2025 03:10:21 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49347: ext4: fix bug_on in ext4_writepages

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug_on in ext4_writepages

we got issue as follows:
EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2708!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
RIP: 0010:ext4_writepages+0x1977/0x1c10
RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_writepages+0x130/0x3a0
 filemap_fdatawrite_wbc+0x83/0xa0
 filemap_flush+0xab/0xe0
 ext4_alloc_da_blocks+0x51/0x120
 __ext4_ioctl+0x1534/0x3210
 __x64_sys_ioctl+0x12c/0x170
 do_syscall_64+0x3b/0x90

It may happen as follows:
1. write inline_data inode
vfs_write
  new_sync_write
    ext4_file_write_iter
      ext4_buffered_write_iter
        generic_perform_write
          ext4_da_write_begin
            ext4_da_write_inline_data_begin -> If inline data size too
            small will allocate block to write, then mapping will has
            dirty page
                ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA
2. fallocate
do_vfs_ioctl
  ioctl_preallocate
    vfs_fallocate
      ext4_fallocate
        ext4_convert_inline_data
          ext4_convert_inline_data_nolock
            ext4_map_blocks -> fail will goto restore data
            ext4_restore_inline_data
              ext4_create_inline_data
              ext4_write_inline_data
              ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA
3. writepages
__ext4_ioctl
  ext4_alloc_da_blocks
    filemap_flush
      filemap_fdatawrite_wbc
        do_writepages
          ext4_writepages
            if (ext4_has_inline_data(inode))
              BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))

The root cause of this issue is we destory inline data until call
ext4_writepages under delay allocation mode.  But there maybe already
convert from inline to extent.  To solve this issue, we call
filemap_flush first..

The Linux kernel CVE team has assigned CVE-2022-49347 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.318 with commit 19918ec7717d87d5ab825884a46b26b21375d7ce
	Fixed in 4.14.283 with commit b2b78f5bf2d453dda3903955efee059260787a42
	Fixed in 4.19.247 with commit de1732b5c1693ad489c5d254f124f67cb775f37d
	Fixed in 5.4.198 with commit 73fd5b19285197078ee8a2e651d75d5b094a4de9
	Fixed in 5.10.121 with commit 1b061af037646c9cdb0afd8a8d2f1e1c06285866
	Fixed in 5.15.46 with commit 18a759f7f99f0b65a08ff5b7e745fc405a42bde4
	Fixed in 5.17.14 with commit 1cde35417edc0370fb0179a4e38b78a15350a8d0
	Fixed in 5.18.3 with commit 013f12bdedb96816aaa27ee04349f4433d361f52
	Fixed in 5.19 with commit ef09ed5d37b84d18562b30cf7253e57062d0db05

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49347
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/inline.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/19918ec7717d87d5ab825884a46b26b21375d7ce
	https://git.kernel.org/stable/c/b2b78f5bf2d453dda3903955efee059260787a42
	https://git.kernel.org/stable/c/de1732b5c1693ad489c5d254f124f67cb775f37d
	https://git.kernel.org/stable/c/73fd5b19285197078ee8a2e651d75d5b094a4de9
	https://git.kernel.org/stable/c/1b061af037646c9cdb0afd8a8d2f1e1c06285866
	https://git.kernel.org/stable/c/18a759f7f99f0b65a08ff5b7e745fc405a42bde4
	https://git.kernel.org/stable/c/1cde35417edc0370fb0179a4e38b78a15350a8d0
	https://git.kernel.org/stable/c/013f12bdedb96816aaa27ee04349f4433d361f52
	https://git.kernel.org/stable/c/ef09ed5d37b84d18562b30cf7253e57062d0db05