CVE-2021-47406

ext4: add error checking to ext4_ext_replay_set_iblocks()

Medium · published May 21, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ext4: add error checking to ext4_ext_replay_set_iblocks()

If the call to ext4_map_blocks() fails due to an corrupted file

system, ext4_ext_replay_set_iblocks() can get stuck in an infinite

loop. This could be reproduced by running generic/526 with a file

system that has inline_data and fast_commit enabled. The system will

repeatedly log to the console:

EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076

and the stack that it gets stuck in is:

ext4_block_to_path+0xe3/0x130

ext4_ind_map_blocks+0x93/0x690

ext4_map_blocks+0x100/0x660

skip_hole+0x47/0x70

ext4_ext_replay_set_iblocks+0x223/0x440

ext4_fc_replay_inode+0x29e/0x3b0

ext4_fc_replay+0x278/0x550

do_one_pass+0x646/0xc10

jbd2_journal_recover+0x14a/0x270

jbd2_journal_load+0xc4/0x150

ext4_load_journal+0x1f3/0x490

ext4_fill_super+0x22d4/0x2c00

With this patch, generic/526 still fails, but system is no longer

locking up in a tight loop. It's likely the root casue is that

fast_commit replay is corrupting file systems with inline_data, and we

probably need to add better error handling in the fast commit replay

code path beyond what is done here, which essentially just breaks the

infinite loop without reporting the to the higher levels of the code.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Published
2024-05-21T15:03Z
EPSS history
Timeline
  • 21 MAY 15:03Z
    ext4: add error checking to ext4_ext_replay_set_iblocks()
    cvelistv5