In the Linux kernel, the following vulnerability has been resolved:
ext4: fix idisksize exceeding isize problem in paritally written case
It is possible for idisksize can exceed isize, triggering a warning.
genericperformwrite copied = iovitercopyfromuseratomic(len) // copied < len ext4dawriteend | ext4updateidisksize | newisize = pos + copied; | WRITEONCE(EXT4I(inode)->idisksize, newsize) // update idisksize | genericwriteend | copied = blockwriteend(copied, len) // copied = 0 | if (unlikely(copied < len)) | if (!PageUptodate(page)) | copied = 0; | if (pos + copied > inode->isize) // return false if (unlikely(copied == 0)) goto again; if (unlikely(ioviterfaultinreadable(i, bytes))) { status = -EFAULT; break; }
We get idisksize greater than isize here, which could trigger WARNING check 'isizeread(inode) < EXT4I(inode)->idisksize' while doing dio:
ext4diowriteiter iomapdiorw _iomapdiorw // return err, length is not aligned to 512 ext4handleinodeextension WARNONONCE(isizeread(inode) < EXT4I(inode)->i_disksize) // Oops
WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4filewriteiter+0xbc7 Call Trace: vfswrite+0x3b1 ksyswrite+0x77 dosyscall_64+0x39
Fix it by updating 'copied' value before updating idisksize just like ext4writeinlinedata_end() does.
A reproducer can be found in the buganizer link below.
[
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101429490025296686570935007685835642255",
"43058666050769621727944819382469346070",
"267474023271209857462144750590921895510"
]
},
"deprecated": false,
"id": "CVE-2023-53270-15c608dd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dedde690303c05ef732b7c5c8356fdf60a4ade3"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "ext4_da_write_end",
"file": "fs/ext4/inode.c"
},
"digest": {
"function_hash": "195990610572671465910570182218373113905",
"length": 833.0
},
"deprecated": false,
"id": "CVE-2023-53270-1902fb3a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d30090eb546d993ea3f3023452540c476ea614a5"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "ext4_da_write_end",
"file": "fs/ext4/inode.c"
},
"digest": {
"function_hash": "195990610572671465910570182218373113905",
"length": 833.0
},
"deprecated": false,
"id": "CVE-2023-53270-1935f986",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18eb23891aeae3229baf8c7c23b76be3364e1967"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101429490025296686570935007685835642255",
"43058666050769621727944819382469346070",
"267474023271209857462144750590921895510"
]
},
"deprecated": false,
"id": "CVE-2023-53270-3c9e9ed1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d30090eb546d993ea3f3023452540c476ea614a5"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101429490025296686570935007685835642255",
"43058666050769621727944819382469346070",
"267474023271209857462144750590921895510"
]
},
"deprecated": false,
"id": "CVE-2023-53270-5bdcfff2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53877ed201baa6b58f7ce9df92664a839113c30e"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101429490025296686570935007685835642255",
"43058666050769621727944819382469346070",
"267474023271209857462144750590921895510"
]
},
"deprecated": false,
"id": "CVE-2023-53270-6581a65e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18eb23891aeae3229baf8c7c23b76be3364e1967"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "ext4_da_write_end",
"file": "fs/ext4/inode.c"
},
"digest": {
"function_hash": "195990610572671465910570182218373113905",
"length": 833.0
},
"deprecated": false,
"id": "CVE-2023-53270-85a9fda3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53877ed201baa6b58f7ce9df92664a839113c30e"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "ext4_da_write_end",
"file": "fs/ext4/inode.c"
},
"digest": {
"function_hash": "195990610572671465910570182218373113905",
"length": 833.0
},
"deprecated": false,
"id": "CVE-2023-53270-8c0320fd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ecea2fee14227712694c8b54ad99d471e61de92"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "ext4_da_write_end",
"file": "fs/ext4/inode.c"
},
"digest": {
"function_hash": "195990610572671465910570182218373113905",
"length": 833.0
},
"deprecated": false,
"id": "CVE-2023-53270-b82917c0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dedde690303c05ef732b7c5c8356fdf60a4ade3"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101429490025296686570935007685835642255",
"43058666050769621727944819382469346070",
"267474023271209857462144750590921895510"
]
},
"deprecated": false,
"id": "CVE-2023-53270-f1930db9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ecea2fee14227712694c8b54ad99d471e61de92"
}
]