In the Linux kernel, the following vulnerability has been resolved:
ext4: fix ext4mbmarkbb() with flexbg with fast_commit
In case of flexbg feature (which is by default enabled), extents for any given inode might span across blocks from two different block group. ext4mbmarkbb() only reads the bufferhead of block bitmap once for the starting block group, but it fails to read it again when the extent length boundary overflows to another block group. Then in this below loop it accesses memory beyond the block group bitmap bufferhead and results into a data abort.
for (i = 0; i < clen; i++)
if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)
already++;
This patch adds this functionality for checking block group boundary in ext4mbmarkbb() and update the bufferhead(bitmap_bh) for every different block group.
w/o this patch, I was easily able to hit a data access abort using Power platform.
<...> [ 74.327662] EXT4-fs error (device loop3): ext4mbgeneratebuddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters [ 74.533214] EXT4-fs (loop3): shut down requested (2) [ 74.536705] Aborting journal on device loop3-8. [ 74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000 [ 74.703727] Faulting instruction address: 0xc0000000007bffb8 cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060] pc: c0000000007bffb8: ext4mbmarkbb+0x198/0x5a0 lr: c0000000007bfeec: ext4mbmarkbb+0xcc/0x5a0 sp: c000000015db7300 msr: 800000000280b033 dar: c00000005e980000 dsisr: 40000000 current = 0xc000000027af6880 paca = 0xc00000003ffd5200 irqmask: 0x03 irqhappened: 0x01 pid = 5167, comm = mount <...> enter ? for help [c000000015db7380] c000000000782708 ext4extclearbb+0x378/0x410 [c000000015db7400] c000000000813f14 ext4fcreplay+0x1794/0x2000 [c000000015db7580] c000000000833f7c doonepass+0xe9c/0x12a0 [c000000015db7710] c000000000834504 jbd2journalrecover+0x184/0x2d0 [c000000015db77c0] c000000000841398 jbd2journalload+0x188/0x4a0 [c000000015db7880] c000000000804de8 ext4fillsuper+0x2638/0x3e10 [c000000015db7a40] c0000000005f8404 gettreebdev+0x2b4/0x350 [c000000015db7ae0] c0000000007ef058 ext4gettree+0x28/0x40 [c000000015db7b00] c0000000005f6344 vfsgettree+0x44/0x100 [c000000015db7b70] c00000000063c408 pathmount+0xdd8/0xe70 [c000000015db7c40] c00000000063c8f0 sysmount+0x450/0x550 [c000000015db7d50] c000000000035770 systemcallexception+0x4a0/0x4e0 [c000000015db7e10] c00000000000c74c systemcall_common+0xec/0x250
[
{
"id": "CVE-2022-49174-08dae148",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_mark_bb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b07eedd0222e9548ffc568ec429bb1f61d21a39c",
"signature_type": "Function",
"digest": {
"function_hash": "183506867978593282998157006753950706918",
"length": 1620.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-0942036f",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_mark_bb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfdc502a4a4c058bf4cbb1df0c297761d528f54d",
"signature_type": "Function",
"digest": {
"function_hash": "183506867978593282998157006753950706918",
"length": 1620.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-0a1eaf69",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_mark_bb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd6d719534af993210306f8a13f9cb3e615f7c8d",
"signature_type": "Function",
"digest": {
"function_hash": "183506867978593282998157006753950706918",
"length": 1620.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-1305c331",
"target": {
"file": "fs/ext4/mballoc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfdc502a4a4c058bf4cbb1df0c297761d528f54d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243056612489839456854571904652069810585",
"27944392052159912926276238155140284599",
"297479211800005964883013907497755594838",
"223376471971010270879120829399484577155",
"112251608852602306801333412260488236404",
"249569275892923836941179761517218116022",
"190163338138478987740843923671593688862",
"164232825643535336858159975883061450097",
"218099461349544132870180059845600050043",
"282301254625626773727139826441061085385",
"129605438269764314799267559084470657679",
"279752928033860478334969429316411796076",
"262316476949172608048866099043825359372",
"96920459514307160919457837539977053902",
"224744955765312734137702361504462580383",
"241961847300563570346634989648038082880",
"31889413112711482722990225312541394499",
"103778162933504815228416196750371084287",
"43425451016294621409834716659405200380",
"193610161169108999713568962464128096206",
"146814894834158524701955020439448700640",
"302067476333896444323969726550099718483",
"291291487122000367082991895713598222836",
"157341345646608227494029965770584371929",
"328138796425066694978044639641175024486",
"90732026929577728094461620203559726352",
"292714530159637046637875827202008461572",
"291753220325683305247683003488733716888",
"119311077703700098181383059935228404475",
"234843065851375003487660587637131346190",
"76483285999839186459232067751758925085",
"79454588835948813025762121442819768067",
"260020265489072482309423157402543530212",
"19922043965227060431288759261680971880",
"226879312038693869420306022501789699966",
"301506419039980215460219849522675881246",
"116798801855955678361481456363557041028",
"31963383194355041901051495131046931089",
"264628975824754921843875539440010535834",
"101441954688457278186939042523651571120",
"160512729913312954103883151003923284628",
"299427360824144400720358807098398917375",
"266013977235561929780660590324667202100",
"30675796790428689708149071635101021446",
"336338794188369616443042084419428836277",
"102958280577052861635186223372730849349",
"264211033699676714588573704961772981514",
"234678527550502206677823825195766694749",
"214166366855400506808742336115967415825",
"292285099784608053577989902193065517374",
"40580934506250537913595842150559607641",
"306082416362062631634366335596392191617",
"171283308914556874292754714130904839371",
"123016070166294987907224784419304049206",
"327026491892423668324969227848277651783",
"135035274811390997404651698381419234712",
"108588653727849767197912089448956951750",
"131340879447313349844537399960327747751"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-1d1a58d1",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_mark_bb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a6beb074186a0452368a023a261c7d0eaebe838",
"signature_type": "Function",
"digest": {
"function_hash": "183506867978593282998157006753950706918",
"length": 1620.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-7ccebe60",
"target": {
"file": "fs/ext4/mballoc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a6beb074186a0452368a023a261c7d0eaebe838",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243056612489839456854571904652069810585",
"27944392052159912926276238155140284599",
"297479211800005964883013907497755594838",
"223376471971010270879120829399484577155",
"112251608852602306801333412260488236404",
"249569275892923836941179761517218116022",
"190163338138478987740843923671593688862",
"164232825643535336858159975883061450097",
"218099461349544132870180059845600050043",
"282301254625626773727139826441061085385",
"129605438269764314799267559084470657679",
"279752928033860478334969429316411796076",
"262316476949172608048866099043825359372",
"96920459514307160919457837539977053902",
"224744955765312734137702361504462580383",
"241961847300563570346634989648038082880",
"31889413112711482722990225312541394499",
"103778162933504815228416196750371084287",
"43425451016294621409834716659405200380",
"193610161169108999713568962464128096206",
"146814894834158524701955020439448700640",
"302067476333896444323969726550099718483",
"291291487122000367082991895713598222836",
"157341345646608227494029965770584371929",
"328138796425066694978044639641175024486",
"90732026929577728094461620203559726352",
"292714530159637046637875827202008461572",
"291753220325683305247683003488733716888",
"119311077703700098181383059935228404475",
"234843065851375003487660587637131346190",
"76483285999839186459232067751758925085",
"79454588835948813025762121442819768067",
"260020265489072482309423157402543530212",
"19922043965227060431288759261680971880",
"226879312038693869420306022501789699966",
"301506419039980215460219849522675881246",
"116798801855955678361481456363557041028",
"31963383194355041901051495131046931089",
"264628975824754921843875539440010535834",
"101441954688457278186939042523651571120",
"160512729913312954103883151003923284628",
"299427360824144400720358807098398917375",
"266013977235561929780660590324667202100",
"30675796790428689708149071635101021446",
"336338794188369616443042084419428836277",
"102958280577052861635186223372730849349",
"264211033699676714588573704961772981514",
"234678527550502206677823825195766694749",
"214166366855400506808742336115967415825",
"292285099784608053577989902193065517374",
"40580934506250537913595842150559607641",
"306082416362062631634366335596392191617",
"171283308914556874292754714130904839371",
"123016070166294987907224784419304049206",
"327026491892423668324969227848277651783",
"135035274811390997404651698381419234712",
"108588653727849767197912089448956951750",
"131340879447313349844537399960327747751"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-7cdac3c3",
"target": {
"file": "fs/ext4/mballoc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd6d719534af993210306f8a13f9cb3e615f7c8d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243056612489839456854571904652069810585",
"27944392052159912926276238155140284599",
"297479211800005964883013907497755594838",
"223376471971010270879120829399484577155",
"112251608852602306801333412260488236404",
"249569275892923836941179761517218116022",
"190163338138478987740843923671593688862",
"164232825643535336858159975883061450097",
"218099461349544132870180059845600050043",
"282301254625626773727139826441061085385",
"129605438269764314799267559084470657679",
"279752928033860478334969429316411796076",
"262316476949172608048866099043825359372",
"96920459514307160919457837539977053902",
"224744955765312734137702361504462580383",
"241961847300563570346634989648038082880",
"31889413112711482722990225312541394499",
"103778162933504815228416196750371084287",
"43425451016294621409834716659405200380",
"193610161169108999713568962464128096206",
"146814894834158524701955020439448700640",
"302067476333896444323969726550099718483",
"291291487122000367082991895713598222836",
"157341345646608227494029965770584371929",
"328138796425066694978044639641175024486",
"90732026929577728094461620203559726352",
"292714530159637046637875827202008461572",
"291753220325683305247683003488733716888",
"119311077703700098181383059935228404475",
"234843065851375003487660587637131346190",
"76483285999839186459232067751758925085",
"79454588835948813025762121442819768067",
"260020265489072482309423157402543530212",
"19922043965227060431288759261680971880",
"226879312038693869420306022501789699966",
"301506419039980215460219849522675881246",
"116798801855955678361481456363557041028",
"31963383194355041901051495131046931089",
"264628975824754921843875539440010535834",
"101441954688457278186939042523651571120",
"160512729913312954103883151003923284628",
"299427360824144400720358807098398917375",
"266013977235561929780660590324667202100",
"30675796790428689708149071635101021446",
"336338794188369616443042084419428836277",
"102958280577052861635186223372730849349",
"264211033699676714588573704961772981514",
"234678527550502206677823825195766694749",
"214166366855400506808742336115967415825",
"292285099784608053577989902193065517374",
"40580934506250537913595842150559607641",
"306082416362062631634366335596392191617",
"171283308914556874292754714130904839371",
"123016070166294987907224784419304049206",
"327026491892423668324969227848277651783",
"135035274811390997404651698381419234712",
"108588653727849767197912089448956951750",
"131340879447313349844537399960327747751"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-b25ecbf5",
"target": {
"file": "fs/ext4/mballoc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803fb0e8240cc16585a5c9df76add1dfaa781773",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243056612489839456854571904652069810585",
"27944392052159912926276238155140284599",
"297479211800005964883013907497755594838",
"223376471971010270879120829399484577155",
"112251608852602306801333412260488236404",
"249569275892923836941179761517218116022",
"190163338138478987740843923671593688862",
"164232825643535336858159975883061450097",
"218099461349544132870180059845600050043",
"282301254625626773727139826441061085385",
"129605438269764314799267559084470657679",
"279752928033860478334969429316411796076",
"262316476949172608048866099043825359372",
"96920459514307160919457837539977053902",
"224744955765312734137702361504462580383",
"241961847300563570346634989648038082880",
"31889413112711482722990225312541394499",
"103778162933504815228416196750371084287",
"43425451016294621409834716659405200380",
"193610161169108999713568962464128096206",
"146814894834158524701955020439448700640",
"302067476333896444323969726550099718483",
"291291487122000367082991895713598222836",
"157341345646608227494029965770584371929",
"328138796425066694978044639641175024486",
"90732026929577728094461620203559726352",
"292714530159637046637875827202008461572",
"291753220325683305247683003488733716888",
"119311077703700098181383059935228404475",
"234843065851375003487660587637131346190",
"76483285999839186459232067751758925085",
"79454588835948813025762121442819768067",
"260020265489072482309423157402543530212",
"19922043965227060431288759261680971880",
"226879312038693869420306022501789699966",
"301506419039980215460219849522675881246",
"116798801855955678361481456363557041028",
"31963383194355041901051495131046931089",
"264628975824754921843875539440010535834",
"101441954688457278186939042523651571120",
"160512729913312954103883151003923284628",
"299427360824144400720358807098398917375",
"266013977235561929780660590324667202100",
"30675796790428689708149071635101021446",
"336338794188369616443042084419428836277",
"102958280577052861635186223372730849349",
"264211033699676714588573704961772981514",
"234678527550502206677823825195766694749",
"214166366855400506808742336115967415825",
"292285099784608053577989902193065517374",
"40580934506250537913595842150559607641",
"306082416362062631634366335596392191617",
"171283308914556874292754714130904839371",
"123016070166294987907224784419304049206",
"327026491892423668324969227848277651783",
"135035274811390997404651698381419234712",
"108588653727849767197912089448956951750",
"131340879447313349844537399960327747751"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-caf7b432",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_mark_bb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803fb0e8240cc16585a5c9df76add1dfaa781773",
"signature_type": "Function",
"digest": {
"function_hash": "183506867978593282998157006753950706918",
"length": 1620.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49174-f04916e5",
"target": {
"file": "fs/ext4/mballoc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b07eedd0222e9548ffc568ec429bb1f61d21a39c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243056612489839456854571904652069810585",
"27944392052159912926276238155140284599",
"297479211800005964883013907497755594838",
"223376471971010270879120829399484577155",
"112251608852602306801333412260488236404",
"249569275892923836941179761517218116022",
"190163338138478987740843923671593688862",
"164232825643535336858159975883061450097",
"218099461349544132870180059845600050043",
"282301254625626773727139826441061085385",
"129605438269764314799267559084470657679",
"279752928033860478334969429316411796076",
"262316476949172608048866099043825359372",
"96920459514307160919457837539977053902",
"224744955765312734137702361504462580383",
"241961847300563570346634989648038082880",
"31889413112711482722990225312541394499",
"103778162933504815228416196750371084287",
"43425451016294621409834716659405200380",
"193610161169108999713568962464128096206",
"146814894834158524701955020439448700640",
"302067476333896444323969726550099718483",
"291291487122000367082991895713598222836",
"157341345646608227494029965770584371929",
"328138796425066694978044639641175024486",
"90732026929577728094461620203559726352",
"292714530159637046637875827202008461572",
"291753220325683305247683003488733716888",
"119311077703700098181383059935228404475",
"234843065851375003487660587637131346190",
"76483285999839186459232067751758925085",
"79454588835948813025762121442819768067",
"260020265489072482309423157402543530212",
"19922043965227060431288759261680971880",
"226879312038693869420306022501789699966",
"301506419039980215460219849522675881246",
"116798801855955678361481456363557041028",
"31963383194355041901051495131046931089",
"264628975824754921843875539440010535834",
"101441954688457278186939042523651571120",
"160512729913312954103883151003923284628",
"299427360824144400720358807098398917375",
"266013977235561929780660590324667202100",
"30675796790428689708149071635101021446",
"336338794188369616443042084419428836277",
"102958280577052861635186223372730849349",
"264211033699676714588573704961772981514",
"234678527550502206677823825195766694749",
"214166366855400506808742336115967415825",
"292285099784608053577989902193065517374",
"40580934506250537913595842150559607641",
"306082416362062631634366335596392191617",
"171283308914556874292754714130904839371",
"123016070166294987907224784419304049206",
"327026491892423668324969227848277651783",
"135035274811390997404651698381419234712",
"108588653727849767197912089448956951750",
"131340879447313349844537399960327747751"
]
},
"deprecated": false,
"signature_version": "v1"
}
]