CVE-2022-50435

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ext4: avoid crash when inline data creation follows DIO write<br /> <br /> When inode is created and written to using direct IO, there is nothing<br /> to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets<br /> truncated later to say 1 byte and written using normal write, we will<br /> try to store the data as inline data. This confuses the code later<br /> because the inode now has both normal block and inline data allocated<br /> and the confusion manifests for example as:<br /> <br /> kernel BUG at fs/ext4/inode.c:2721!<br /> invalid opcode: 0000 [#1] PREEMPT SMP KASAN<br /> CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014<br /> RIP: 0010:ext4_writepages+0x363d/0x3660<br /> RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293<br /> RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180<br /> RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000<br /> RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b<br /> R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128<br /> R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001<br /> FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0<br /> Call Trace:<br /> <br /> do_writepages+0x397/0x640<br /> filemap_fdatawrite_wbc+0x151/0x1b0<br /> file_write_and_wait_range+0x1c9/0x2b0<br /> ext4_sync_file+0x19e/0xa00<br /> vfs_fsync_range+0x17b/0x190<br /> ext4_buffered_write_iter+0x488/0x530<br /> ext4_file_write_iter+0x449/0x1b90<br /> vfs_write+0xbcd/0xf40<br /> ksys_write+0x198/0x2c0<br /> __x64_sys_write+0x7b/0x90<br /> do_syscall_64+0x3d/0x90<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> <br /> Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing<br /> direct IO write to a file.