In the Linux kernel, the following vulnerability has been resolved:
ext4: fix race condition between ext4write and ext4convertinlinedata
Hulk Robot reported a BUGON: ================================================================== EXT4-fs error (device loop3): ext4mbgeneratebuddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4putnojournal fs/ext4/ext4jbd2.c:53 [inline] RIP: 0010:_ext4journalstop+0x10e/0x110 fs/ext4/ext4jbd2.c:116 [...] Call Trace: ext4writeinlinedataend+0x59a/0x730 fs/ext4/inline.c:795 genericperformwrite+0x279/0x3c0 mm/filemap.c:3344 ext4bufferedwriteiter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4filewriteiter+0x30a/0x11c0 fs/ext4/file.c:520 doiterreadvwritev+0x339/0x3c0 fs/readwrite.c:732 doiterwrite+0x107/0x430 fs/readwrite.c:861 vfswritev fs/readwrite.c:934 [inline] dopwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ==================================================================
Above issue may happen as follows: cpu1 cpu2 _|_ dopwritev vfswritev doiterwrite ext4filewriteiter ext4bufferedwriteiter genericperformwrite ext4dawritebegin vfsfallocate ext4fallocate ext4convertinlinedata ext4convertinlinedatanolock ext4destroyinlinedatanolock clear EXT4STATEMAYINLINEDATA ext4mapblocks ext4extmapblocks ext4mbnewblocks ext4mbregularallocator ext4mbgoodgroupnolock ext4mbinitgroup ext4mbinitcache ext4mbgeneratebuddy --> error ext4testinodestate(inode, EXT4STATEMAYINLINEDATA) ext4restoreinlinedata set EXT4STATEMAYINLINEDATA ext4blockwritebegin ext4dawriteend ext4testinodestate(inode, EXT4STATEMAYINLINEDATA) ext4writeinlinedataend handle=NULL ext4journalstop(handle) _ext4journalstop ext4putnojournal(handle) refcnt = (unsigned long)handle BUGON(refcnt == 0) ---> BUGON
The lock held by ext4convertinlinedata is xattrsem, but the lock held by genericperformwrite is i_rwsem. Therefore, the two locks can be concurrent.
To solve above issue, we add inodelock() for ext4convertinlinedata(). At the same time, move ext4convertinlinedata() in front of ext4punchhole(), remove similar handling from ext4punch_hole().
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14602353b350950b551eccc6b46411aa3b12ffe2",
"id": "CVE-2022-49414-0aa1a1c6",
"digest": {
"line_hashes": [
"224096427674523506740843282749845380772",
"290095584537517113821052654156433186701",
"151155551337501889035811366432300798866",
"268372025837622072930786906839599381214",
"91542285191793013348449256788584305455",
"260268074762739035148814965126456779453",
"200831352567246008354971993043268550879",
"191772619785865856319516575735098550849",
"67947542589536108979593898598219964704",
"248967063178875138641655321115000703961"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725e00cb7039eae291890f1bb19bc867176745f6",
"id": "CVE-2022-49414-182695df",
"digest": {
"function_hash": "204713038889440806876987637917796943585",
"length": 2633.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18881d7e517169193d9ef6c89c7f322e3e164277",
"id": "CVE-2022-49414-19d89c9f",
"digest": {
"function_hash": "213538380548215612188281329313931893949",
"length": 1778.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87c7a4b084afc13190cbb263538e444cb2b392a",
"id": "CVE-2022-49414-271cf9c9",
"digest": {
"line_hashes": [
"958362091222779387956308923859754861",
"239584560613250212310871771679713386336",
"69489605627668481409017433743771153363",
"85822639713613691335763484008489265837",
"43426588521132288102704916611094851126",
"168744040002152326248113941798254985582",
"20478703227892869802072425833137447262",
"174118216547595670053053606207109760839",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
"id": "CVE-2022-49414-3b6d606a",
"digest": {
"function_hash": "204713038889440806876987637917796943585",
"length": 2633.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18881d7e517169193d9ef6c89c7f322e3e164277",
"id": "CVE-2022-49414-4404dd59",
"digest": {
"line_hashes": [
"166196524424684520715240297289823956750",
"303288238181914291360631049414500650867",
"211986171460660783853270894225347875064",
"89570679169566308184074914187950359686",
"25766457019201700063145666300095832264",
"138436015525398617657749832048521265007",
"334015594081335525612049252823815723707",
"181715615459013524870940965279497928582",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
"id": "CVE-2022-49414-4cb45131",
"digest": {
"line_hashes": [
"958362091222779387956308923859754861",
"239584560613250212310871771679713386336",
"69489605627668481409017433743771153363",
"85822639713613691335763484008489265837",
"43426588521132288102704916611094851126",
"168744040002152326248113941798254985582",
"20478703227892869802072425833137447262",
"174118216547595670053053606207109760839",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725e00cb7039eae291890f1bb19bc867176745f6",
"id": "CVE-2022-49414-4ea5efbd",
"digest": {
"function_hash": "279323689030272292191549574705711884449",
"length": 1803.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18881d7e517169193d9ef6c89c7f322e3e164277",
"id": "CVE-2022-49414-510a20fb",
"digest": {
"line_hashes": [
"142149920261612579472290861607062215342",
"242352373947403091579551341927753156767",
"49612206157400708980852663723515359100",
"23665854906517035275030587526449135996",
"234379171988095510692971453833220179365",
"226203476287228681555434130992719434413",
"134571794285270809297854352478916851452",
"245623988149256798760631540084772901779"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
"id": "CVE-2022-49414-57f5bfd7",
"digest": {
"function_hash": "211423468200163036688895909932359105845",
"length": 2749.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87c7a4b084afc13190cbb263538e444cb2b392a",
"id": "CVE-2022-49414-5d9ad820",
"digest": {
"function_hash": "204713038889440806876987637917796943585",
"length": 2633.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
"id": "CVE-2022-49414-86ab7daa",
"digest": {
"line_hashes": [
"958362091222779387956308923859754861",
"239584560613250212310871771679713386336",
"211986171460660783853270894225347875064",
"89570679169566308184074914187950359686",
"25766457019201700063145666300095832264",
"138436015525398617657749832048521265007",
"334015594081335525612049252823815723707",
"181715615459013524870940965279497928582",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14602353b350950b551eccc6b46411aa3b12ffe2",
"id": "CVE-2022-49414-94f6bfe8",
"digest": {
"function_hash": "188448202695667298312834318025121138710",
"length": 1841.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
"id": "CVE-2022-49414-95526e6f",
"digest": {
"function_hash": "279323689030272292191549574705711884449",
"length": 1803.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
"id": "CVE-2022-49414-97293149",
"digest": {
"line_hashes": [
"112113572108237951083761344866014927970",
"314398531891438190028112528074511268067",
"121568399082145208077443048813078421052",
"268372025837622072930786906839599381214",
"91542285191793013348449256788584305455",
"260268074762739035148814965126456779453",
"200831352567246008354971993043268550879",
"191772619785865856319516575735098550849",
"67947542589536108979593898598219964704",
"248967063178875138641655321115000703961"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14602353b350950b551eccc6b46411aa3b12ffe2",
"id": "CVE-2022-49414-97920b60",
"digest": {
"function_hash": "204713038889440806876987637917796943585",
"length": 2633.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18881d7e517169193d9ef6c89c7f322e3e164277",
"id": "CVE-2022-49414-b10fca3b",
"digest": {
"function_hash": "56637067684224940909577242508198821014",
"length": 2710.0
},
"target": {
"function": "ext4_punch_hole",
"file": "fs/ext4/inode.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
"id": "CVE-2022-49414-c3730747",
"digest": {
"function_hash": "188448202695667298312834318025121138710",
"length": 1841.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725e00cb7039eae291890f1bb19bc867176745f6",
"id": "CVE-2022-49414-cf22acfb",
"digest": {
"line_hashes": [
"112113572108237951083761344866014927970",
"314398531891438190028112528074511268067",
"121568399082145208077443048813078421052",
"268372025837622072930786906839599381214",
"91542285191793013348449256788584305455",
"260268074762739035148814965126456779453",
"200831352567246008354971993043268550879",
"191772619785865856319516575735098550849",
"67947542589536108979593898598219964704",
"248967063178875138641655321115000703961"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
"id": "CVE-2022-49414-d4ae3bfa",
"digest": {
"line_hashes": [
"244574479627295777713789267987383900474",
"224096427674523506740843282749845380772",
"290095584537517113821052654156433186701",
"151155551337501889035811366432300798866",
"268372025837622072930786906839599381214",
"91542285191793013348449256788584305455",
"260268074762739035148814965126456779453",
"200831352567246008354971993043268550879",
"191772619785865856319516575735098550849",
"67947542589536108979593898598219964704",
"248967063178875138641655321115000703961"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14602353b350950b551eccc6b46411aa3b12ffe2",
"id": "CVE-2022-49414-d6ef5f00",
"digest": {
"line_hashes": [
"958362091222779387956308923859754861",
"239584560613250212310871771679713386336",
"69489605627668481409017433743771153363",
"85822639713613691335763484008489265837",
"43426588521132288102704916611094851126",
"168744040002152326248113941798254985582",
"20478703227892869802072425833137447262",
"174118216547595670053053606207109760839",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87c7a4b084afc13190cbb263538e444cb2b392a",
"id": "CVE-2022-49414-e5b08ff1",
"digest": {
"line_hashes": [
"112113572108237951083761344866014927970",
"314398531891438190028112528074511268067",
"121568399082145208077443048813078421052",
"268372025837622072930786906839599381214",
"91542285191793013348449256788584305455",
"260268074762739035148814965126456779453",
"200831352567246008354971993043268550879",
"191772619785865856319516575735098550849",
"67947542589536108979593898598219964704",
"248967063178875138641655321115000703961"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/extents.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725e00cb7039eae291890f1bb19bc867176745f6",
"id": "CVE-2022-49414-e64fef95",
"digest": {
"line_hashes": [
"958362091222779387956308923859754861",
"239584560613250212310871771679713386336",
"69489605627668481409017433743771153363",
"85822639713613691335763484008489265837",
"43426588521132288102704916611094851126",
"168744040002152326248113941798254985582",
"20478703227892869802072425833137447262",
"174118216547595670053053606207109760839",
"294755750631154486538914270048883456446",
"228990016028919239366326284468732814400",
"127454410431062024394975878476782482635"
],
"threshold": 0.9
},
"target": {
"file": "fs/ext4/inode.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87c7a4b084afc13190cbb263538e444cb2b392a",
"id": "CVE-2022-49414-eacfcd56",
"digest": {
"function_hash": "279323689030272292191549574705711884449",
"length": 1803.0
},
"target": {
"function": "ext4_fallocate",
"file": "fs/ext4/extents.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]