linux-cve-announce - CVE-2023-54069: ext4: fix BUG in ext4_mb_new_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122431-CVE-2023-54069-1a17@gregkh>
Date: Wed, 24 Dec 2025 13:27:02 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54069: ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow

When we calculate the end position of ext4_free_extent, this position may
be exactly where ext4_lblk_t (i.e. uint) overflows. For example, if
ac_g_ex.fe_logical is 4294965248 and ac_orig_goal_len is 2048, then the
computed end is 0x100000000, which is 0. If ac->ac_o_ex.fe_logical is not
the first case of adjusting the best extent, that is, new_bex_end > 0, the
following BUG_ON will be triggered:

=========================================================
kernel BUG at fs/ext4/mballoc.c:5116!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 673 Comm: xfs_io Tainted: G E 6.5.0-rc1+ #279
RIP: 0010:ext4_mb_new_inode_pa+0xc5/0x430
Call Trace:
 <TASK>
 ext4_mb_use_best_found+0x203/0x2f0
 ext4_mb_try_best_found+0x163/0x240
 ext4_mb_regular_allocator+0x158/0x1550
 ext4_mb_new_blocks+0x86a/0xe10
 ext4_ext_map_blocks+0xb0c/0x13a0
 ext4_map_blocks+0x2cd/0x8f0
 ext4_iomap_begin+0x27b/0x400
 iomap_iter+0x222/0x3d0
 __iomap_dio_rw+0x243/0xcb0
 iomap_dio_rw+0x16/0x80
=========================================================

A simple reproducer demonstrating the problem:

	mkfs.ext4 -F /dev/sda -b 4096 100M
	mount /dev/sda /tmp/test
	fallocate -l1M /tmp/test/tmp
	fallocate -l10M /tmp/test/file
	fallocate -i -o 1M -l16777203M /tmp/test/file
	fsstress -d /tmp/test -l 0 -n 100000 -p 8 &
	sleep 10 && killall -9 fsstress
	rm -f /tmp/test/tmp
	xfs_io -c "open -ad /tmp/test/file" -c "pwrite -S 0xff 0 8192"

We simply refactor the logic for adjusting the best extent by adding
a temporary ext4_free_extent ex and use extent_logical_end() to avoid
overflow, which also simplifies the code.

The Linux kernel CVE team has assigned CVE-2023-54069 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.4.244 with commit 8659c5f4ffaacbe932849b98462c3d635b4eacea and fixed in 5.4.260 with commit 83ecffd40c65844a73c2e93d7c841455786605ac
	Issue introduced in 5.10.181 with commit fc7237e191b99f88e859316fab2b06c2c26c8344 and fixed in 5.10.200 with commit 58fe961c606c446f5612f6897827b1cac42c2e89
	Issue introduced in 5.15.113 with commit 613f6cde5ebb005a37fda117cdda7b4126170c13 and fixed in 5.15.138 with commit f2c3a3aa6f11ad9878dbc3a067b0633e07b586c1
	Issue introduced in 6.1.30 with commit 9d4430b7f862ce8835ca4e054b6916d15c8e0862 and fixed in 6.1.61 with commit fcefddf3a151b2c416b20120c06bb1ba9ad676fb
	Issue introduced in 6.4 with commit 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 and fixed in 6.5.5 with commit b7e9ec38b6a0beb5a49cd1e76be0a9a07c218e90
	Issue introduced in 6.4 with commit 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 and fixed in 6.6 with commit bc056e7163ac7db945366de219745cf94f32a3e6
	Issue introduced in 4.14.316 with commit 46772ab99409cc72241227dd8f5295f358233fda
	Issue introduced in 4.19.284 with commit 25a60b4533268477920faaeebd99e7e69c0735cd
	Issue introduced in 6.3.4 with commit cec4ef62b36b04e0bc8905732adab091f4bc1cfd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54069
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/mballoc.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/83ecffd40c65844a73c2e93d7c841455786605ac
	https://git.kernel.org/stable/c/58fe961c606c446f5612f6897827b1cac42c2e89
	https://git.kernel.org/stable/c/f2c3a3aa6f11ad9878dbc3a067b0633e07b586c1
	https://git.kernel.org/stable/c/fcefddf3a151b2c416b20120c06bb1ba9ad676fb
	https://git.kernel.org/stable/c/b7e9ec38b6a0beb5a49cd1e76be0a9a07c218e90
	https://git.kernel.org/stable/c/bc056e7163ac7db945366de219745cf94f32a3e6