CVE-2024-39276

ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()

Medium · published June 25, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()

Syzbot reports a warning as follows:

============================================

WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290

Modules linked in:

CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7

RIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419

Call Trace:

<TASK>

ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375

generic_shutdown_super+0x136/0x2d0 fs/super.c:641

kill_block_super+0x44/0x90 fs/super.c:1675

ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327

[...]

============================================

This is because when finding an entry in ext4_xattr_block_cache_find(), if

ext4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown

in the __entry_find(), won't be put away, and eventually trigger the above

issue in mb_cache_destroy() due to reference count leakage.

So call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Published
2024-06-25T14:22Z
EPSS history
Timeline
  • 25 JUN 14:22Z
    ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
    cvelistv5