linux-ext4 - [BUG] kernel BUG in mb_mark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOU40uBdtsGgG9mi1sZvLSa9rdh_SVAeQkv6B5gjMubcmTDgTQ@mail.gmail.com>
Date: Fri, 23 May 2025 16:11:53 +0800
From: Xianying Wang <wangxianying546@...il.com>
To: tytso@....edu
Cc: adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: [BUG] kernel BUG in mb_mark_used

Hi,

I discovered a kernel crash described as "kernel BUG in mb_mark_used",
which is triggered by a BUG_ON() in the ext4 function
mb_mark_used()(fs/ext4/mballoc.c:2051). The crash occurs when the
expression start + len > (e4b->bd_sb->s_blocksize << 3) evaluates
true, indicating that the block range to be marked as used exceeds the
size of the bitmap. This suggests that an invalid or corrupted block
extent was passed to the allocator, potentially due to inconsistent
internal state or a logic flaw in the extent calculation.

The call trace shows the crash is triggered via a direct I/O write
operation (ext4_dio_write_iter), which ultimately invokes
ext4_mb_new_blocks() and its subroutine mb_mark_used(). The crash is
reproducible using a crafted workload involving mounting an ext4
loopback device and issuing writes.

This may indicate a latent inconsistency in ext4's multiblock
allocation logic (mballoc.c), especially under specific block size or
extent configurations. Further investigation is recommended in the
validation of input to mb_mark_used() and in protecting against block
range overflows.

This can be reproduced on:

HEAD commit:

commit e8f897f4afef0031fe618a8e94127a0934896aba

report: https://pastebin.com/raw/EHJyW2Ev

console output : https://pastebin.com/raw/vKPznSCn

kernel config : https://pastebin.com/raw/aJ9rUnhG

C reproducer : https://pastebin.com/raw/rZ5xcbt5

Best regards,

Xianying