Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 523d5a4df3c649fa305c89efb552ec62a1ce9d3daffected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < ca408af08544d96769c93a3d81a7f63f61129e95affected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 55576fa14771d33994c29a9ae960e07bb3f56c20affected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < dbc4e10619ed87a50e637b96f2e574df36a7a769affected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 61e372122b6d95aec940fdaea0a16f988f359897affected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 3924aea2c33df3864929c1acd178bfc29d8f005faffected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 81982a11406c5da6c6e2b188028e7056e16b7128affected0087d9fb3f29f59e8d42c8b058376d80e5adde4c to < 94a8cea54cd935c54fa2fba70354757c0fc245e3affected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d ↗
- https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95 ↗
- https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20 ↗
- https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769 ↗
- https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897 ↗
- https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f ↗
- https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128 ↗
- https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3 ↗