This is a note to let you know that I've just added the patch titled
ext4: remove a BUG_ON in ext4_mb_release_group_pa()
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ext4-remove-a-bug_on-in-ext4_mb_release_group_pa.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 463808f237cf73e98a1a45ff7460c2406a150a0b Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Sat, 29 Apr 2023 16:14:46 -0400
Subject: ext4: remove a BUG_ON in ext4_mb_release_group_pa()
From: Theodore Ts'o <tytso@xxxxxxx>
commit 463808f237cf73e98a1a45ff7460c2406a150a0b upstream.
If a malicious fuzzer overwrites the ext4 superblock while it is
mounted such that the s_first_data_block is set to a very large
number, the calculation of the block group can underflow, and trigger
a BUG_ON check. Change this to be an ext4_warning so that we don't
crash the kernel.
Cc: stable@xxxxxxxxxx
Link: https://lore.kernel.org/r/20230430154311.579720-3-tytso@xxxxxxx
Reported-by: syzbot+e2efa3efc15a1c9e95c3@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext4/mballoc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4832,7 +4832,11 @@ ext4_mb_release_group_pa(struct ext4_bud
trace_ext4_mb_release_group_pa(sb, pa);
BUG_ON(pa->pa_deleted == 0);
ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
- BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
+ if (unlikely(group != e4b->bd_group && pa->pa_len != 0)) {
+ ext4_warning(sb, "bad group: expected %u, group %u, pa_start %llu",
+ e4b->bd_group, group, pa->pa_pstart);
+ return 0;
+ }
mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
Patches currently in stable-queue which might be from tytso@xxxxxxx are
queue-5.15/ext4-improve-error-recovery-code-paths-in-__ext4_remount.patch
queue-5.15/ext4-fix-warning-in-mb_find_extent.patch
queue-5.15/ext4-fix-deadlock-when-converting-an-inline-directory-in-nojournal-mode.patch
queue-5.15/ext4-bail-out-of-ext4_xattr_ibody_get-fails-for-any-reason.patch
queue-5.15/ext4-improve-error-handling-from-ext4_dirhash.patch
queue-5.15/ext4-add-bounds-checking-in-get_max_inline_xattr_value_size.patch
queue-5.15/ext4-avoid-a-potential-slab-out-of-bounds-in-ext4_group_desc_csum.patch
queue-5.15/ext4-check-iomap-type-only-if-ext4_iomap_begin-does-not-fail.patch
queue-5.15/ext4-fix-invalid-free-tracking-in-ext4_xattr_move_to_block.patch
queue-5.15/ext4-remove-a-bug_on-in-ext4_mb_release_group_pa.patch
queue-5.15/ext4-fix-data-races-when-using-cached-status-extents.patch
