linux-cve-announce - CVE-2022-50346: ext4: init quota for 'old.inode' in 'ext4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025091639-CVE-2022-50346-49b1@gregkh>
Date: Tue, 16 Sep 2025 18:11:42 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50346: ext4: init quota for 'old.inode' in 'ext4_rename'

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: init quota for 'old.inode' in 'ext4_rename'

Syzbot found the following issue:
ext4_parse_param: s_want_extra_isize=128
ext4_inode_info_init: s_want_extra_isize=32
ext4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828
__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128
__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128
ext4_xattr_block_set: inode=ffff88823869a2c8
------------[ cut here ]------------
WARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980
Modules linked in:
RIP: 0010:ext4_xattr_block_set.cold+0x22/0x980
RSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000
RDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178
RBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e
R10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000
R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000
FS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? ext4_xattr_set_entry+0x3b7/0x2320
 ? ext4_xattr_block_set+0x0/0x2020
 ? ext4_xattr_set_entry+0x0/0x2320
 ? ext4_xattr_check_entries+0x77/0x310
 ? ext4_xattr_ibody_set+0x23b/0x340
 ext4_xattr_move_to_block+0x594/0x720
 ext4_expand_extra_isize_ea+0x59a/0x10f0
 __ext4_expand_extra_isize+0x278/0x3f0
 __ext4_mark_inode_dirty.cold+0x347/0x410
 ext4_rename+0xed3/0x174f
 vfs_rename+0x13a7/0x2510
 do_renameat2+0x55d/0x920
 __x64_sys_rename+0x7d/0xb0
 do_syscall_64+0x3b/0xa0
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

As 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,
which may trigger expand 'extra_isize' and allocate block. If inode
didn't init quota will lead to warning.  To solve above issue, init
'old.inode' firstly in 'ext4_rename'.

The Linux kernel CVE team has assigned CVE-2022-50346 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.337 with commit 67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5
	Fixed in 4.14.303 with commit 33fd7031d634f3b46e59f61adfbb0ea9fe514fef
	Fixed in 4.19.270 with commit 7dfb8259f66faafa68d23a261b284d2c2c67649b
	Fixed in 5.4.229 with commit f263e349bacc2f303526dcfa61c4bc50132418b1
	Fixed in 5.10.163 with commit 84a2f2ed49d6a4d92b354219077434c57d334620
	Fixed in 5.15.87 with commit def7a39091e60e1c4a2f623629082a00092602be
	Fixed in 6.0.18 with commit 135ba9146f4d38abed48a540ef8a8770ff0bd34f
	Fixed in 6.1.4 with commit 13271fbbe85d73a7c47058f56a52f2a7f00d6e39
	Fixed in 6.2 with commit fae381a3d79bb94aa2eb752170d47458d778b797

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50346
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/namei.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5
	https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef
	https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b
	https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1
	https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620
	https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be
	https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f
	https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39
	https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797