CVE-2022-49414

一、漏洞信息
 漏洞编号：[CVE-2022-49414](https://nvd.nist.gov/vuln/detail/CVE-2022-49414)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ext4: fix race condition between ext4_write and ext4_convert_inline_dataHulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace:  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732  do_iter_write+0x107/0x430 fs/read_write.c:861  vfs_writev fs/read_write.c:934 [inline]  do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ==================================================================Above issue may happen as follows:           cpu1                     cpu2__________________________|__________________________do_pwritev vfs_writev  do_iter_write   ext4_file_write_iter    ext4_buffered_write_iter     generic_perform_write      ext4_da_write_begin                           vfs_fallocate                            ext4_fallocate                             ext4_convert_inline_data                              ext4_convert_inline_data_nolock                               ext4_destroy_inline_data_nolock                                clear EXT4_STATE_MAY_INLINE_DATA                               ext4_map_blocks                                ext4_ext_map_blocks                                 ext4_mb_new_blocks                                  ext4_mb_regular_allocator                                   ext4_mb_good_group_nolock                                    ext4_mb_init_group                                     ext4_mb_init_cache                                      ext4_mb_generate_buddy  --> error       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)                                ext4_restore_inline_data                                 set EXT4_STATE_MAY_INLINE_DATA       ext4_block_write_begin      ext4_da_write_end       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)       ext4_write_inline_data_end        handle=NULL        ext4_journal_stop(handle)         __ext4_journal_stop          ext4_put_nojournal(handle)           ref_cnt = (unsigned long)handle           BUG_ON(ref_cnt == 0)  ---> BUG_ONThe lock held by ext4_convert_inline_data is xattr_sem, but the lockheld by generic_perform_write is i_rwsem. Therefore, the two locks canbe concurrent.To solve above issue, we add inode_lock() for ext4_convert_inline_data().At the same time, move ext4_convert_inline_data() in front ofext4_punch_hole(), remove similar handling from ext4_punch_hole().
 漏洞公开时间：2025-02-26 15:01:17
 漏洞创建时间：2025-02-26 15:24:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49414
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49414 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49414.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348332 | https://bugzilla.suse.com/show_bug.cgi?id=1238623 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ext4: fix race condition between ext4_write and ext4_convert_inline_dataHulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace:  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732  do_iter_write+0x107/0x430 fs/read_write.c:861  vfs_writev fs/read_write.c:934 [inline]  do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ==================================================================Above issue may happen as follows:           cpu1                     cpu2__________________________|__________________________do_pwritev vfs_writev  do_iter_write   ext4_file_write_iter    ext4_buffered_write_iter     generic_perform_write      ext4_da_write_begin                           vfs_fallocate                            ext4_fallocate                             ext4_convert_inline_data                              ext4_convert_inline_data_nolock                               ext4_destroy_inline_data_nolock                                clear EXT4_STATE_MAY_INLINE_DATA                               ext4_map_blocks                                ext4_ext_map_blocks                                 ext4_mb_new_blocks                                  ext4_mb_regular_allocator                                   ext4_mb_good_group_nolock                                    ext4_mb_init_group                                     ext4_mb_init_cache                                      ext4_mb_generate_buddy  --> error       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)                                ext4_restore_inline_data                                 set EXT4_STATE_MAY_INLINE_DATA       ext4_block_write_begin      ext4_da_write_end       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)       ext4_write_inline_data_end        handle=NULL        ext4_journal_stop(handle)         __ext4_journal_stop          ext4_put_nojournal(handle)           ref_cnt = (unsigned long)handle           BUG_ON(ref_cnt == 0)  ---> BUG_ONThe lock held by ext4_convert_inline_data is xattr_sem, but the lockheld by generic_perform_write is i_rwsem. Therefore, the two locks canbe concurrent.To solve above issue, we add inode_lock() for ext4_convert_inline_data().At the same time, move ext4_convert_inline_data() in front ofext4_punch_hole(), remove similar handling from ext4_punch_hole().
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.master(6.6.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1317

src-openEuler/kernel
关闭

内容风险标识

评论 (5)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49414

评论 (5)

搜索帮助

src-openEuler/kernel
关闭