In the Linux kernel, the following vulnerability has been resolved:
ext4: fix double-free of blocks due to wrong extents moved_len
In ext4moveextents(), movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not zero. When the loop fails to exit after successfully moving some extents, moved_len is not updated and remains at 0, so it does not discard the preallocations.
If the moved extents overlap with the preallocated extents, the overlapped extents are freed twice in ext4mbreleaseinodepa() and ext4processfreeddata() (as described in commit 94d7c16cbbbd ("ext4: Fix double-free of blocks with EXT4IOCMOVEEXT")), and bbfree is incremented twice. Hence when trim is executed, a zero-division bug is triggered in mbupdateavgfragmentsize() because bbfree is not zero and bb_fragments is zero.
Therefore, update move_len after each extent move to avoid the issue.
[
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559ddacb90da1d8786dd8ec4fd76bbfa404eaef6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-17da056f",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559ddacb90da1d8786dd8ec4fd76bbfa404eaef6",
"digest": {
"length": 2565.0,
"function_hash": "160202763812266228126395321076789338525"
},
"deprecated": false,
"id": "CVE-2024-26704-21fcf0cc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4fbb89d722cbb16beaaea234b7230faaaf68c71",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"173450818798775427020399386719426039511"
]
},
"deprecated": false,
"id": "CVE-2024-26704-26034397",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d033a555d9a1cf53dbf3301af7199cc4a4c8f537",
"digest": {
"length": 2596.0,
"function_hash": "285701851600290490443971842930663387871"
},
"deprecated": false,
"id": "CVE-2024-26704-483b514c",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4fbb89d722cbb16beaaea234b7230faaaf68c71",
"digest": {
"length": 2588.0,
"function_hash": "263683569588182266826506148838505591739"
},
"deprecated": false,
"id": "CVE-2024-26704-51705c0b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afbcad9ae7d6d11608399188f03a837451b6b3a1",
"digest": {
"length": 2588.0,
"function_hash": "263683569588182266826506148838505591739"
},
"deprecated": false,
"id": "CVE-2024-26704-5a7e7e09",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@185eab30486ba3e7bf8b9c2e049c79a06ffd2bc1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-620cafef",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55583e899a5357308274601364741a83e78d6ac4",
"digest": {
"length": 2565.0,
"function_hash": "160202763812266228126395321076789338525"
},
"deprecated": false,
"id": "CVE-2024-26704-7b11c341",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@185eab30486ba3e7bf8b9c2e049c79a06ffd2bc1",
"digest": {
"length": 2565.0,
"function_hash": "160202763812266228126395321076789338525"
},
"deprecated": false,
"id": "CVE-2024-26704-810f0b9a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55583e899a5357308274601364741a83e78d6ac4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-9697f11e",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afba9d11320dad5ce222ac8964caf64b7b4bedb1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-b07404ac",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2883940b19c38d5884c8626483811acf4d7e148f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-b46e2109",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afba9d11320dad5ce222ac8964caf64b7b4bedb1",
"digest": {
"length": 2596.0,
"function_hash": "285701851600290490443971842930663387871"
},
"deprecated": false,
"id": "CVE-2024-26704-bd4c1f5f",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afbcad9ae7d6d11608399188f03a837451b6b3a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"173450818798775427020399386719426039511"
]
},
"deprecated": false,
"id": "CVE-2024-26704-c7bab943",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ext4_move_extents",
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2883940b19c38d5884c8626483811acf4d7e148f",
"digest": {
"length": 2565.0,
"function_hash": "160202763812266228126395321076789338525"
},
"deprecated": false,
"id": "CVE-2024-26704-e60f1598",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "fs/ext4/move_extent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d033a555d9a1cf53dbf3301af7199cc4a4c8f537",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269023921211788334491495794144604114546",
"107868528167129434417192827680190028777",
"277489747341654273406757725174976475575",
"37257927880197166672477002552685937321",
"329390851549115661726955184647782079409",
"102385689779614956274935685477822992565",
"253477095431778616155109600441649131926",
"79204219958101503966660802578202724162",
"249874700670750791320735043888062329870",
"254535338054601509413963703981791183576",
"334791894686491076465773732548882534916",
"190177868794642529399050090468267790248",
"205493531569953391647738337185414698805"
]
},
"deprecated": false,
"id": "CVE-2024-26704-fe6793c1",
"signature_type": "Line"
}
]