CVE-2022-49409

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ext4: fix bug_on in __es_tree_search<br /> <br /> Hulk Robot reported a BUG_ON:<br /> ==================================================================<br /> kernel BUG at fs/ext4/extents_status.c:199!<br /> [...]<br /> RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline]<br /> RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217<br /> [...]<br /> Call Trace:<br /> ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766<br /> ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561<br /> ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964<br /> ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384<br /> ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567<br /> ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980<br /> ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031<br /> ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257<br /> v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63<br /> v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82<br /> vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368<br /> dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490<br /> ext4_quota_enable fs/ext4/super.c:6137 [inline]<br /> ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163<br /> ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754<br /> mount_bdev+0x2e9/0x3b0 fs/super.c:1158<br /> mount_fs+0x4b/0x1e4 fs/super.c:1261<br /> [...]<br /> ==================================================================<br /> <br /> Above issue may happen as follows:<br /> -------------------------------------<br /> ext4_fill_super<br /> ext4_enable_quotas<br /> ext4_quota_enable<br /> ext4_iget<br /> __ext4_iget<br /> ext4_ext_check_inode<br /> ext4_ext_check<br /> __ext4_ext_check<br /> ext4_valid_extent_entries<br /> Check for overlapping extents does&amp;#39;t take effect<br /> dquot_enable<br /> vfs_load_quota_inode<br /> v2_check_quota_file<br /> v2_read_header<br /> ext4_quota_read<br /> ext4_bread<br /> ext4_getblk<br /> ext4_map_blocks<br /> ext4_ext_map_blocks<br /> ext4_find_extent<br /> ext4_cache_extents<br /> ext4_es_cache_extent<br /> ext4_es_cache_extent<br /> __es_tree_search<br /> ext4_es_end<br /> BUG_ON(es-&gt;es_lblk + es-&gt;es_len es_lblk)<br /> <br /> The error ext4 extents is as follows:<br /> 0af3 0300 0400 0000 00000000 extent_header<br /> 00000000 0100 0000 12000000 extent1<br /> 00000000 0100 0000 18000000 extent2<br /> 02000000 0400 0000 14000000 extent3<br /> <br /> In the ext4_valid_extent_entries function,<br /> if prev is 0, no error is returned even if lblock