In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: reject oversized group bitmap descriptors<\/p>\n
ocfs2_validate_gd_parent() only bounds bg_bits against the parent
\nallocator’s chain geometry. A malicious descriptor can still claim a
\nbg_size\/bg_bits pair that exceeds the bitmap bytes that physically fit in
\nthe group descriptor block, so later bitmap scans and bit updates can run
\npast bg_bitmap.<\/p>\n
Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent
\nallocator type and reject descriptors whose bg_size or bg_bits exceed that
\ncapacity. Keep the existing chain geometry check so both the on-disk
\nbitmap layout and the allocator metadata must agree before the descriptor
\nis used.<\/p>\n
Validation reproduced this kernel report:
\nKASAN use-after-free in _find_next_bit+0x7f\/0xc0
\nRead of size 8
\nCall trace:
\n dump_stack_lvl+0x66\/0xa0 (?:?)
\n print_report+0xd0\/0x630 (?:?)
\n _find_next_bit+0x7f\/0xc0 (?:?)
\n srso_alias_return_thunk+0x5\/0xfbef5 (?:?)
\n __virt_addr_valid+0x188\/0x2f0 (?:?)
\n kasan_report+0xe4\/0x120 (?:?)
\n ocfs2_find_max_contig_free_bits+0x35\/0x70 (fs\/ocfs2\/suballoc.c:1375)
\n ocfs2_block_group_set_bits+0x472\/0x4b0 (fs\/ocfs2\/suballoc.c:1457)
\n ocfs2_cluster_group_search+0x16b\/0x440 (fs\/ocfs2\/suballoc.c:86)
\n ocfs2_bg_discontig_fix_result+0x1ef\/0x230 (fs\/ocfs2\/suballoc.c:1786)
\n ocfs2_search_chain+0x8f8\/0x10a0 (fs\/ocfs2\/suballoc.c:1886)
\n get_page_from_freelist+0x70e\/0x2370 (?:?)
\n lock_release+0xc6\/0x290 (?:?)
\n do_raw_spin_unlock+0x9a\/0x100 (?:?)
\n kasan_unpoison+0x27\/0x60 (?:?)
\n __bfs+0x147\/0x240 (?:?)
\n get_page_from_freelist+0x83d\/0x2370 (?:?)
\n ocfs2_claim_suballoc_bits+0x38c\/0xe70 (fs\/ocfs2\/suballoc.c:96)
\n sched_domains_numa_masks_clear+0x70\/0xd0 (?:?)
\n check_irq_usage+0xe8\/0xb70 (?:?)
\n __ocfs2_claim_clusters+0x18d\/0x4c0 (fs\/ocfs2\/suballoc.c:2497)
\n check_path+0x24\/0x50 (?:?)
\n rcu_is_watching+0x20\/0x50 (?:?)
\n check_prev_add+0xfd\/0xd00 (?:?)
\n ocfs2_add_clusters_in_btree+0x17d\/0x810 (fs\/ocfs2\/suballoc.c:?)
\n __folio_batch_add_and_move+0x1f5\/0x3d0 (?:?)
\n ocfs2_add_inode_data+0xd9\/0x120 (fs\/ocfs2\/suballoc.c:?)
\n filemap_add_folio+0x105\/0x1f0 (?:?)
\n ocfs2_write_begin_nolock+0x29f7\/0x2f80 (fs\/ocfs2\/suballoc.c:3043)
\n ocfs2_read_inode_block+0xb5\/0x110 (fs\/ocfs2\/suballoc.c:?)
\n down_write+0xf5\/0x180 (?:?)
\n ocfs2_write_begin+0x180\/0x240 (fs\/ocfs2\/suballoc.c:?)
\n __mark_inode_dirty+0x758\/0x9a0 (?:?)
\n inode_to_bdi+0x41\/0x90 (?:?)
\n balance_dirty_pages_ratelimited_flags+0xf8\/0x1d0 (?:?)
\n generic_perform_write+0x252\/0x440 (?:?)
\n mnt_put_write_access_file+0x16\/0x70 (?:?)
\n file_update_time_flags+0xe4\/0x200 (?:?)
\n ocfs2_file_write_iter+0x80a\/0x1320 (fs\/ocfs2\/suballoc.c:?)
\n lock_acquire+0x184\/0x2f0 (?:?)
\n ksys_write+0xd2\/0x170 (?:?)
\n apparmor_file_permission+0xf5\/0x310 (?:?)
\n read_zero+0x8d\/0x140 (?:?)
\n lock_is_held_type+0x8f\/0x100 (?:?)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: reject oversized group bitmap descriptors<\/p>\n
ocfs2_validate_gd_parent() only bounds bg_bits against the parent
\nallocator’s cha<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14874","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14874","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14874"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14874"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14874"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}