CVE-2022-49879
ext4: fix BUG_ON() when directory entry has invalid rec_len
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
ext4: fix BUG_ON() when directory entry has invalid rec_len
In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir(). ------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.
Reserved 2025-05-01 | Published 2025-05-01 | Updated 2025-05-04 | Assigner Linuxgit.kernel.org/...c/2fa24d0274fbf913b56ee31f15bc01168669d909
git.kernel.org/...c/156451a67b93986fb07c274ef6995ff40766c5ad
git.kernel.org/...c/999cff2b6ce3b45c08abf793bf55534777421327
git.kernel.org/...c/ce1ee2c8827fb6493e91acbd50f664cf2a972c3d
git.kernel.org/...c/17a0bc9bd697f75cfdf9b378d5eb2d7409c91340
Support options
