Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-54069

ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow When we calculate the end position of ext4_free_extent, this position may be exactly where ext4_lblk_t (i.e. uint) overflows. For example, if ac_g_ex.fe_logical is 4294965248 and ac_orig_goal_len is 2048, then the computed end is 0x100000000, which is 0. If ac->ac_o_ex.fe_logical is not the first case of adjusting the best extent, that is, new_bex_end > 0, the following BUG_ON will be triggered: ========================================================= kernel BUG at fs/ext4/mballoc.c:5116! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 673 Comm: xfs_io Tainted: G E 6.5.0-rc1+ #279 RIP: 0010:ext4_mb_new_inode_pa+0xc5/0x430 Call Trace: <TASK> ext4_mb_use_best_found+0x203/0x2f0 ext4_mb_try_best_found+0x163/0x240 ext4_mb_regular_allocator+0x158/0x1550 ext4_mb_new_blocks+0x86a/0xe10 ext4_ext_map_blocks+0xb0c/0x13a0 ext4_map_blocks+0x2cd/0x8f0 ext4_iomap_begin+0x27b/0x400 iomap_iter+0x222/0x3d0 __iomap_dio_rw+0x243/0xcb0 iomap_dio_rw+0x16/0x80 ========================================================= A simple reproducer demonstrating the problem: mkfs.ext4 -F /dev/sda -b 4096 100M mount /dev/sda /tmp/test fallocate -l1M /tmp/test/tmp fallocate -l10M /tmp/test/file fallocate -i -o 1M -l16777203M /tmp/test/file fsstress -d /tmp/test -l 0 -n 100000 -p 8 & sleep 10 && killall -9 fsstress rm -f /tmp/test/tmp xfs_io -c "open -ad /tmp/test/file" -c "pwrite -S 0xff 0 8192" We simply refactor the logic for adjusting the best extent by adding a temporary ext4_free_extent ex and use extent_logical_end() to avoid overflow, which also simplifies the code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8659c5f4ffaacbe932849b98462c3d635b4eacea to < 83ecffd40c65844a73c2e93d7c841455786605acaffected
  • fc7237e191b99f88e859316fab2b06c2c26c8344 to < 58fe961c606c446f5612f6897827b1cac42c2e89affected
  • 613f6cde5ebb005a37fda117cdda7b4126170c13 to < f2c3a3aa6f11ad9878dbc3a067b0633e07b586c1affected
  • 9d4430b7f862ce8835ca4e054b6916d15c8e0862 to < fcefddf3a151b2c416b20120c06bb1ba9ad676fbaffected
  • 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 to < b7e9ec38b6a0beb5a49cd1e76be0a9a07c218e90affected
  • 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 to < bc056e7163ac7db945366de219745cf94f32a3e6affected
  • 46772ab99409cc72241227dd8f5295f358233fdaaffected
  • 25a60b4533268477920faaeebd99e7e69c0735cdaffected
  • cec4ef62b36b04e0bc8905732adab091f4bc1cfdaffected
  • 5.4.244 to < 5.4.260affected
  • 5.10.181 to < 5.10.200affected
  • 5.15.113 to < 5.15.138affected
  • 6.1.30 to < 6.1.61affected
  • 4.14.316 to < 4.15affected
  • 4.19.284 to < 4.20affected
  • 6.3.4 to < 6.4affected

Linux Linux

Default version status: affected

  • 6.4affected
  • 0 to < 6.4unaffected
  • 5.4.260 to ≤ 5.4.*unaffected
  • 5.10.200 to ≤ 5.10.*unaffected
  • 5.15.138 to ≤ 5.15.*unaffected
  • 6.1.61 to ≤ 6.1.*unaffected
  • 6.5.5 to ≤ 6.5.*unaffected
  • 6.6 to ≤ *unaffected

References