linux-ext4 - [BUG] WARNING in mb_avg_fragment_size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJNGr6v57z_RR5fNV+tLuGXEVKLRfXdo+hNS81HzztaC7pgchA@mail.gmail.com>
Date: Tue, 20 May 2025 13:12:11 +0800
From: Guoyu Yin <y04609127@...il.com>
To: "Theodore Ts'o" <tytso@....edu>
Cc: adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: [BUG] WARNING in mb_avg_fragment_size_order

Hi,

This crash can be triggered by repeatedly performing specific file
operations, causing a kernel warning in the Ext4 multi-block allocator
(mballoc) module. The issue arises in mb_avg_fragment_size_order due
to an invalid len parameter leading to an out-of-bound order, thus
triggering the WARNING.

Root Cause:
1. Code Path: In ext4_mb_choose_next_group_best_avail(),
ac_g_ex.fe_len might be incorrectly calculated as an excessively large
value (e.g., via roundup).
2. Invalid Parameter: When ac_g_ex.fe_len is too large, order =
fls(len) - 2 in mb_avg_fragment_size_order() exceeds
MB_NUM_ORDERS(sb), triggering WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)).

Code Locations:
fs/ext4/mballoc.c:834.

Proposed Fix:
1. Add validity checks for ac_g_ex.fe_len in
ext4_mb_choose_next_group_best_avail() to ensure it does not exceed 1
<< (MB_NUM_ORDERS(sb) + 2).
2. Enforce strict input validation for len in
mb_avg_fragment_size_order() to reject invalid values.

This can be reproduced on:
HEAD commit:

fac04efc5c793dccbd07e2d59af9f90b7fc0dca4

report: https://pastebin.com/raw/W5ejqsNx

console output : https://pastebin.com/raw/U9qUGBhY

kernel config: https://pastebin.com/raw/zrj9jd1V

C reproducer : https://pastebin.com/raw/TCwWzfaH

Best regards,
Guoyu