In the Linux kernel, the following vulnerability has been resolved:
ext4: fix delayed allocation bug in ext4clumapped for bigalloc + inline
When converting files with inline data to extents, delayed allocations made on a file system created with both the bigalloc and inline options can result in invalid extent status cache content, incorrect reserved cluster counts, kernel memory leaks, and potential kernel panics.
With bigalloc, the code that determines whether a block must be delayed allocated searches the extent tree to see if that block maps to a previously allocated cluster. If not, the block is delayed allocated, and otherwise, it isn't. However, if the inline option is also used, and if the file containing the block is marked as able to store data inline, there isn't a valid extent tree associated with the file. The current code in ext4clumapped() calls ext4findextent() to search the non-existent tree for a previously allocated cluster anyway, which typically finds nothing, as desired. However, a side effect of the search can be to cache invalid content from the non-existent tree (garbage) in the extent status tree, including bogus entries in the pending reservation tree.
To fix this, avoid searching the extent tree when allocating blocks for bigalloc + inline files that are being converted from inline to extent mapped.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50286.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents_status.h"
},
"id": "CVE-2022-50286-0e8feb2f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"line_hashes": [
"316756957887393267233337979081274200664",
"92368174038183782924860272686441107663",
"65339829201756658311173757116694276179",
"282383304613646058140669568156450187033",
"168802281985026913940224437980146948353",
"177424646376343222413838863446598552835",
"39838108463525926960444898457394668106",
"247489600021256884820434426601436483495",
"35348827214510635335440906829102084135",
"260873577702357679228891946515333855255",
"189500154030819601615992212358211640036",
"146848436804087926298750338734878305511",
"46586204074287739255113494274447321578",
"167161858036272690990717119478985051345"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_clu_mapped"
},
"id": "CVE-2022-50286-17d2b66e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f4200ec76a0d31200c308ec5a71c68df5417004",
"digest": {
"function_hash": "336545616838509226189139834862550590940",
"length": 1005.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/inode.c",
"function": "ext4_da_map_blocks"
},
"id": "CVE-2022-50286-25b005a8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "27088835447856202308725193158219859337",
"length": 2271.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c"
},
"id": "CVE-2022-50286-2deb498d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9404839e0c9db5a517ea83c0ca3388b39d105fdf",
"digest": {
"line_hashes": [
"320921355784945700798311820412066019287",
"33181516325069386529490050267729949760",
"237655855773162100136503421220703172680"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/inode.c",
"function": "ext4_insert_delayed_block"
},
"id": "CVE-2022-50286-3832f23d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "28620774349727280499019466951574986499",
"length": 629.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c"
},
"id": "CVE-2022-50286-4ba5e586",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c8edbc8abbe8f16d80a1d794d1ba2c12b6f193",
"digest": {
"line_hashes": [
"320921355784945700798311820412066019287",
"33181516325069386529490050267729949760",
"237655855773162100136503421220703172680"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_clu_mapped"
},
"id": "CVE-2022-50286-65ce656c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9404839e0c9db5a517ea83c0ca3388b39d105fdf",
"digest": {
"function_hash": "336545616838509226189139834862550590940",
"length": 1005.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents_status.c"
},
"id": "CVE-2022-50286-823454f3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"line_hashes": [
"291022089764981935667415969415345699014",
"276426853488776670001317590967904333391",
"208955786858630608929667882506338064437",
"65485010982985248431598273659345449898",
"261382284481291420887848198345940939689",
"146293099065333141427083506347647556665",
"60486707870781862086250517657847325662",
"227013353144956886834510583763119254223",
"327925075517827314569164346252016012321",
"7904815040541627108267223445656620519",
"10161536210127561223154193219512795038",
"46175091794283205553450861417547891067",
"120208607696263295130951973607575184560",
"17953020172650449028349103263087269481",
"56028748067520683216754484899569594921",
"331616474660955341417202225380428391070",
"336867009140163251142143001509476886694",
"149110773633735153753006871003297267408",
"331178904485697692326922458425360389383",
"251153776100717441556977928839168675216",
"236172162322594084289699335393625615621",
"321092919150633561287060782329371380223",
"234659289805075128267938200645778493273",
"140975590725112087756653157660825736802",
"157005820796849167827256485432038334141",
"128913568583263904133594857515005616375",
"65672110915709390096561035793210190240",
"277780483572427529547178367891805621637",
"283505705452594568400928595356224247478",
"328194122967905715221099409733852827744",
"276074145976875599627902831900583209058"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c"
},
"id": "CVE-2022-50286-82fdb45a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f4200ec76a0d31200c308ec5a71c68df5417004",
"digest": {
"line_hashes": [
"320921355784945700798311820412066019287",
"33181516325069386529490050267729949760",
"237655855773162100136503421220703172680"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents_status.h",
"function": "ext4_es_is_delonly"
},
"id": "CVE-2022-50286-8a1d0c73",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "216577792588261723564400506912222558684",
"length": 106.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/trace/events/ext4.h"
},
"id": "CVE-2022-50286-90569bad",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"line_hashes": [
"170766707926263907338896581175533816234",
"161609085395369497493858461388797340319",
"192768287996305496165900940540991983692",
"277709329274597008491174215075384399409",
"102170702661533703260857148161197418271",
"234249106313886526475216603608641554669",
"9690252605789071598681233281389590116",
"299229378962846234152738373134305673102",
"216946627778718245453739219393630271934",
"301163056349041669044924195346349687521",
"113966996026769086374055837810867839580",
"175089190822014239067270072693703110717",
"17848848763255117301956234229444057805",
"142249932087836477286307633112147678722",
"66640885509747415949407834511127922003",
"333270134923802923667135078787611321123",
"74468841397936510322673219487167564352",
"284104113757414757438732900813805518308",
"205614184804686252835869568560092385000",
"53258492867064092083332273775210784694",
"125032298117285360740456183840681966218",
"89599077932200994014457185857996399717",
"82382245429040627619663359616771360147",
"282833594474245656514158344354227743403",
"217155043219814257200516517525700836751",
"201980477136815832557566151015292816986",
"320304163779469396202616282184251243002",
"82276902388684063861985165983787558903",
"276716701702824654965524415201573137185",
"32336193035254762758125256072521710477",
"45073518899552575372091000297431159066",
"282468635656594703659151673847058277056",
"13974005565550527636156796297375213941"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/inode.c"
},
"id": "CVE-2022-50286-93e0bf4c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"line_hashes": [
"95349334495738469150803201862068009834",
"119468375010647154661969095546920209656",
"177300419697475390266126400292658292658",
"33672153778744779327002622759517731096",
"79193090916550088766359646511650839643",
"305601267388277916171140678693935576873",
"95557732488489089868730055512628637126",
"161760272806229208685676841833925410900",
"112271350704345041910234193501771366123",
"82442450144983195875171193380137471034",
"303561353325950227853825259345002717672",
"186727197871880692698732669402954280623",
"71686286121272960178952550780682253057",
"263904988547666509172998008148319307648",
"74054174003619691269212574253642565214",
"213325017175144490077586595697887680397",
"154959092721170500031097485926566524381",
"165613293907207687233696490394405595278",
"139823300501146404218325381284754571566",
"185486405278366543263456480441694631749",
"258092306074110351297054777004668148975",
"82442450144983195875171193380137471034",
"21644024128023696255346350278916803740",
"74389951756141240717312384951301916975",
"328366356746521269378233385490512192291",
"14563914253612832404967401493507216966",
"83083911624311447742808248856318663423",
"306854069293921481491125758190560490428",
"182495093834486970642806214208858130502",
"130639332205273081526492980091666600402",
"319462836918860866633300743816457590775",
"98490740454301982678509991093672990842",
"253209075021298967526945796503330037784",
"100025058162985852391885125751277807914",
"91378957867558279786579249147385123979",
"197647529252647369113819882775222320393",
"199178662296374796995036125399566619424",
"69277755547716183224962140289271752943",
"276821995693627064113816127320488785062",
"143224682684486478687194079198314244619",
"159104607594714899354711219876914344811"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents_status.c",
"function": "ext4_es_insert_delayed_block"
},
"id": "CVE-2022-50286-9e098577",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "9692606765451094223054232641219977312",
"length": 802.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents_status.h",
"function": "ext4_es_is_mapped"
},
"id": "CVE-2022-50286-af2ccf0e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "101466886441752190078694087707479639931",
"length": 104.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/ext4.h"
},
"id": "CVE-2022-50286-b39552dc",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"line_hashes": [
"62943899904380358256564128252991570380",
"192772749364841610883569099390238284466",
"50742877768679700141485794073823408483",
"69439603861184028155531384968116725627"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_clu_mapped"
},
"id": "CVE-2022-50286-d234380d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83391339d8493b9ff24167516aaa5a5e88d8f81",
"digest": {
"function_hash": "336545616838509226189139834862550590940",
"length": 1005.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_clu_mapped"
},
"id": "CVE-2022-50286-fb6b3689",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c8edbc8abbe8f16d80a1d794d1ba2c12b6f193",
"digest": {
"function_hash": "336545616838509226189139834862550590940",
"length": 1005.0
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50286.json"