In the Linux kernel, the following vulnerability has been resolved:
ext4: don't BUG if someone dirty pages without asking ext4 first
[un]pinuserpagesremote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by processvm_writev(2) which was discovered by Syzbot[2].
This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost).
So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2].
[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com
[
{
"id": "CVE-2022-49171-1690fa8b",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"125739768716528995178055366294602027713",
"254974692788816333774688789539473129530",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@677c9d30e8487bee6c8e3b034070319d98f6e203",
"deprecated": false
},
{
"id": "CVE-2022-49171-1badb53f",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1060.0,
"function_hash": "87109713291061305225355079947066784213"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db60e76edf5680ff1f3a7221036fc44b308f146",
"deprecated": false
},
{
"id": "CVE-2022-49171-269a7b1b",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1581.0,
"function_hash": "5278624825286870517229798524859663952"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db60e76edf5680ff1f3a7221036fc44b308f146",
"deprecated": false
},
{
"id": "CVE-2022-49171-35ef7bc4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1250.0,
"function_hash": "4196681661483682057209771418343371713"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343117559ef41e992e326f7a92da1a8f254dfa8c",
"deprecated": false
},
{
"id": "CVE-2022-49171-4e952091",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1520.0,
"function_hash": "301968867094337583719338882411361774044"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0856764dc1276ad2dc7891288c2e9246bf11a37",
"deprecated": false
},
{
"id": "CVE-2022-49171-55e5e55c",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"277461120178472708944652643256932351349",
"145160177079468616493000318949717806552",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330d0e44fc5a47c27df958ecdd4693a3cb1d8b81",
"deprecated": false
},
{
"id": "CVE-2022-49171-6166a7a4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1252.0,
"function_hash": "270713585894313660226367234305040513661"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a016c053f426a73752c3b41b60b497b58694d48",
"deprecated": false
},
{
"id": "CVE-2022-49171-61d04def",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1230.0,
"function_hash": "175579970446877600027215010852607747119"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d666dfaa571465a19f014534a214c255ea33f301",
"deprecated": false
},
{
"id": "CVE-2022-49171-6b3c18a6",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"277461120178472708944652643256932351349",
"145160177079468616493000318949717806552",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3a6926f7e8be3c897fa46216ce13b119a9f56a",
"deprecated": false
},
{
"id": "CVE-2022-49171-71cdfd33",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1252.0,
"function_hash": "270713585894313660226367234305040513661"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330d0e44fc5a47c27df958ecdd4693a3cb1d8b81",
"deprecated": false
},
{
"id": "CVE-2022-49171-75ca402e",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1520.0,
"function_hash": "301968867094337583719338882411361774044"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@677c9d30e8487bee6c8e3b034070319d98f6e203",
"deprecated": false
},
{
"id": "CVE-2022-49171-92119235",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"277461120178472708944652643256932351349",
"145160177079468616493000318949717806552",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d666dfaa571465a19f014534a214c255ea33f301",
"deprecated": false
},
{
"id": "CVE-2022-49171-9d8ea976",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1250.0,
"function_hash": "4196681661483682057209771418343371713"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@677c9d30e8487bee6c8e3b034070319d98f6e203",
"deprecated": false
},
{
"id": "CVE-2022-49171-a0c0d813",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"125739768716528995178055366294602027713",
"254974692788816333774688789539473129530",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0856764dc1276ad2dc7891288c2e9246bf11a37",
"deprecated": false
},
{
"id": "CVE-2022-49171-a282a4b6",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1520.0,
"function_hash": "301968867094337583719338882411361774044"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc5095747edfb054ca2068d01af20be3fcc3634f",
"deprecated": false
},
{
"id": "CVE-2022-49171-a2e3f893",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1230.0,
"function_hash": "175579970446877600027215010852607747119"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3a6926f7e8be3c897fa46216ce13b119a9f56a",
"deprecated": false
},
{
"id": "CVE-2022-49171-a4ac5430",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1250.0,
"function_hash": "4196681661483682057209771418343371713"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc5095747edfb054ca2068d01af20be3fcc3634f",
"deprecated": false
},
{
"id": "CVE-2022-49171-a95df5f5",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1250.0,
"function_hash": "4196681661483682057209771418343371713"
},
"target": {
"function": "ext4_writepage",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0856764dc1276ad2dc7891288c2e9246bf11a37",
"deprecated": false
},
{
"id": "CVE-2022-49171-a9749385",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1581.0,
"function_hash": "5278624825286870517229798524859663952"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d666dfaa571465a19f014534a214c255ea33f301",
"deprecated": false
},
{
"id": "CVE-2022-49171-b1402f9a",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"277461120178472708944652643256932351349",
"145160177079468616493000318949717806552",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a016c053f426a73752c3b41b60b497b58694d48",
"deprecated": false
},
{
"id": "CVE-2022-49171-bdb3cd1e",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1490.0,
"function_hash": "151161438709092317508339153538755155438"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3a6926f7e8be3c897fa46216ce13b119a9f56a",
"deprecated": false
},
{
"id": "CVE-2022-49171-d0f3a9e6",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"125739768716528995178055366294602027713",
"254974692788816333774688789539473129530",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc5095747edfb054ca2068d01af20be3fcc3634f",
"deprecated": false
},
{
"id": "CVE-2022-49171-d6520523",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"277461120178472708944652643256932351349",
"145160177079468616493000318949717806552",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db60e76edf5680ff1f3a7221036fc44b308f146",
"deprecated": false
},
{
"id": "CVE-2022-49171-ddde4cba",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1520.0,
"function_hash": "301968867094337583719338882411361774044"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330d0e44fc5a47c27df958ecdd4693a3cb1d8b81",
"deprecated": false
},
{
"id": "CVE-2022-49171-e14d45e8",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330352658175057477610042696340985448530",
"125739768716528995178055366294602027713",
"254974692788816333774688789539473129530",
"19340138910759709021926186686158658810",
"87345490782343138489822144527378820891",
"62060690437994822942881383207230579066"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343117559ef41e992e326f7a92da1a8f254dfa8c",
"deprecated": false
},
{
"id": "CVE-2022-49171-e9fb926a",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1520.0,
"function_hash": "301968867094337583719338882411361774044"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343117559ef41e992e326f7a92da1a8f254dfa8c",
"deprecated": false
},
{
"id": "CVE-2022-49171-f4ebaf4b",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1490.0,
"function_hash": "151161438709092317508339153538755155438"
},
"target": {
"function": "mpage_prepare_extent_to_map",
"file": "fs/ext4/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a016c053f426a73752c3b41b60b497b58694d48",
"deprecated": false
}
]