Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem!
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < 5ed0496e383cb6de120e56991385dce70bbb87c1affected8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < 0619f7750f2b178a1309808832ab20d85e0ad121affected8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < 181e63cd595c688194e07332f9944b3a63193de2affected8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < c6e67df64783e99a657ef2b8c834ba2bf54c539caffected8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < 81f819c537d29932e4b9267f02411cbc8b355178affected8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 to < 907c3fe532253a6ef4eb9c4d67efb71fab58c706affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected5.10.224 to ≤ 5.10.*unaffected5.15.165 to ≤ 5.15.*unaffected6.1.103 to ≤ 6.1.*unaffected6.6.44 to ≤ 6.6.*unaffected6.10.3 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5ed0496e383cb6de120e56991385dce70bbb87c1 ↗
- https://git.kernel.org/stable/c/0619f7750f2b178a1309808832ab20d85e0ad121 ↗
- https://git.kernel.org/stable/c/181e63cd595c688194e07332f9944b3a63193de2 ↗
- https://git.kernel.org/stable/c/c6e67df64783e99a657ef2b8c834ba2bf54c539c ↗
- https://git.kernel.org/stable/c/81f819c537d29932e4b9267f02411cbc8b355178 ↗
- https://git.kernel.org/stable/c/907c3fe532253a6ef4eb9c4d67efb71fab58c706 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗