In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug_on ext4_mb_use_inode_pa

Hulk Robot reported a BUG_ON:

kernel BUG at fs/ext4/mballoc.c:3211! […] RIP: 0010:ext4_mb_mark_diskspace_used.cold+0x85/0x136f […] Call Trace: ext4_mb_new_blocks+0x9df/0x5d30 ext4_ext_map_blocks+0x1803/0x4d80 ext4_map_blocks+0x3a4/0x1a10 ext4_writepages+0x126d/0x2c30 do_writepages+0x7f/0x1b0 __filemap_fdatawrite_range+0x285/0x3b0 file_write_and_wait_range+0xb1/0x140 ext4_sync_file+0x1aa/0xca0 vfs_fsync_range+0xfb/0x260 do_fsync+0x48/0xa0 […]

Above issue may happen as follows:

do_fsync vfs_fsync_range ext4_sync_file file_write_and_wait_range __filemap_fdatawrite_range do_writepages ext4_writepages mpage_map_and_submit_extent mpage_map_one_extent ext4_map_blocks ext4_mb_new_blocks ext4_mb_normalize_request »> start + size <= ac->ac_o_ex.fe_logical ext4_mb_regular_allocator ext4_mb_simple_scan_group ext4_mb_use_best_found ext4_mb_new_preallocation ext4_mb_new_inode_pa ext4_mb_use_inode_pa »> set ac->ac_b_ex.fe_len <= 0 ext4_mb_mark_diskspace_used »> BUG_ON(ac->ac_b_ex.fe_len <= 0);

we can easily reproduce this problem with the following commands: fallocate -l100M disk mkfs.ext4 -b 1024 -g 256 disk mount disk /mnt fsstress -d /mnt -l 0 -n 1000 -p 1

The size must be smaller than or equal to EXT4_BLOCKS_PER_GROUP. Therefore, start + size <= ac->ac_o_ex.fe_logical may occur when the size is truncated. So start should be the start position of the group where ac_o_ex.fe_logical is located after alignment. In addition, when the value of fe_logical or EXT4_BLOCKS_PER_GROUP is very large, the value calculated by start_off is more accurate.

Weakness

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Software

Extended Description

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Potential Mitigations

References

• https://git.kernel.org/stable/c/5707d721d1819db57dba57b1d4623034fcb32047
• https://git.kernel.org/stable/c/6880fb2e64331b9fdc85d3f32b1d7e81ad8703f1
• https://git.kernel.org/stable/c/6fdaf31ad5f3d3afab744dfd9a8b0d9142aa881f
• https://git.kernel.org/stable/c/887a3e9ad4b8309a2266bce7ae749b2bf1f7a687
• https://git.kernel.org/stable/c/90f0f9d45dff0128c0fca0d2358c4153b024afa6
• https://git.kernel.org/stable/c/a08f789d2ab5242c07e716baf9a835725046be89
• https://git.kernel.org/stable/c/a37c1359714da42517dd19d36fc3c4d17edba832
• https://git.kernel.org/stable/c/a6b31616e5afe1d3972cb0682a373e50597faf5c