| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: avoid online resizing failures due to oversized flex bg |
| |
| When we online resize an ext4 filesystem with a oversized flexbg_size, |
| |
| mkfs.ext4 -F -G 67108864 $dev -b 4096 100M |
| mount $dev $dir |
| resize2fs $dev 16G |
| |
| the following WARN_ON is triggered: |
| ================================================================== |
| WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550 |
| Modules linked in: sg(E) |
| CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314 |
| RIP: 0010:__alloc_pages+0x411/0x550 |
| Call Trace: |
| <TASK> |
| __kmalloc_large_node+0xa2/0x200 |
| __kmalloc+0x16e/0x290 |
| ext4_resize_fs+0x481/0xd80 |
| __ext4_ioctl+0x1616/0x1d90 |
| ext4_ioctl+0x12/0x20 |
| __x64_sys_ioctl+0xf0/0x150 |
| do_syscall_64+0x3b/0x90 |
| ================================================================== |
| |
| This is because flexbg_size is too large and the size of the new_group_data |
| array to be allocated exceeds MAX_ORDER. Currently, the minimum value of |
| MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding |
| maximum number of groups that can be allocated is: |
| |
| (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845 |
| |
| And the value that is down-aligned to the power of 2 is 16384. Therefore, |
| this value is defined as MAX_RESIZE_BG, and the number of groups added |
| each time does not exceed this value during resizing, and is added multiple |
| times to complete the online resizing. The difference is that the metadata |
| in a flex_bg may be more dispersed. |
| |
| The Linux kernel CVE team has assigned CVE-2023-52622 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.19.307 with commit cd1f93ca97a9136989f3bd2bf90696732a2ed644 |
| Fixed in 5.4.269 with commit b183fe8702e78bba3dcef8e7193cab6898abee07 |
| Fixed in 5.10.210 with commit cfbbb3199e71b63fc26cee0ebff327c47128a1e8 |
| Fixed in 5.15.149 with commit d76c8d7ffe163c6bf2f1ef680b0539c2b3902b90 |
| Fixed in 6.1.77 with commit 6d2cbf517dcabc093159cf138ad5712c9c7fa954 |
| Fixed in 6.6.16 with commit 8b1413dbfe49646eda2c00c0f1144ee9d3368e0c |
| Fixed in 6.7.4 with commit dc3e0f55bec4410f3d74352c4a7c79f518088ee2 |
| Fixed in 6.8 with commit 5d1935ac02ca5aee364a449a35e2977ea84509b0 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52622 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/resize.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/cd1f93ca97a9136989f3bd2bf90696732a2ed644 |
| https://git.kernel.org/stable/c/b183fe8702e78bba3dcef8e7193cab6898abee07 |
| https://git.kernel.org/stable/c/cfbbb3199e71b63fc26cee0ebff327c47128a1e8 |
| https://git.kernel.org/stable/c/d76c8d7ffe163c6bf2f1ef680b0539c2b3902b90 |
| https://git.kernel.org/stable/c/6d2cbf517dcabc093159cf138ad5712c9c7fa954 |
| https://git.kernel.org/stable/c/8b1413dbfe49646eda2c00c0f1144ee9d3368e0c |
| https://git.kernel.org/stable/c/dc3e0f55bec4410f3d74352c4a7c79f518088ee2 |
| https://git.kernel.org/stable/c/5d1935ac02ca5aee364a449a35e2977ea84509b0 |
