In the Linux kernel, the following vulnerability has been resolved:
ext4: fix mbcacheentry's erefcnt leak in ext4xattrblockcache_find()
Syzbot reports a warning as follows:
============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mbcachedestroy+0x224/0x290 Modules linked in: CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7 RIP: 0010:mbcachedestroy+0x224/0x290 fs/mbcache.c:419 Call Trace: <TASK> ext4putsuper+0x6d4/0xcd0 fs/ext4/super.c:1375 genericshutdownsuper+0x136/0x2d0 fs/super.c:641 killblocksuper+0x44/0x90 fs/super.c:1675 ext4killsb+0x68/0xa0 fs/ext4/super.c:7327
This is because when finding an entry in ext4xattrblockcachefind(), if ext4sbbread() returns -ENOMEM, the ce's erefcnt, which has already grown in the _entryfind(), won't be put away, and eventually trigger the above issue in mbcache_destroy() due to reference count leakage.
So call mbcacheentry_put() on the -ENOMEM error branch as a quick fix.
[
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-39276-15c5a81f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76dc776153a47372719d664e0fc50d6355791abb",
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c",
"function": "ext4_xattr_block_cache_find"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-39276-17bf9105",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a95df6f04f2c37291adf26a74205cde0314d4577",
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c",
"function": "ext4_xattr_block_cache_find"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-39276-42eb8840",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e941b712e758f615d311946bf98216e79145ccd9",
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c",
"function": "ext4_xattr_block_cache_find"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-39276-46cbfb44",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@896a7e7d0d555ad8b2b46af0c2fa7de7467f9483",
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c",
"function": "ext4_xattr_block_cache_find"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-39276-479fb42d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@681ff9a09accd8a4379f8bd30b7a1641ee19bb3e",
"digest": {
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-39276-4dc786fb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@896a7e7d0d555ad8b2b46af0c2fa7de7467f9483",
"digest": {
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-39276-67d2fd0b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76dc776153a47372719d664e0fc50d6355791abb",
"digest": {
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-39276-9310e2fd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a95df6f04f2c37291adf26a74205cde0314d4577",
"digest": {
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-39276-fef9707c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@681ff9a09accd8a4379f8bd30b7a1641ee19bb3e",
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c",
"function": "ext4_xattr_block_cache_find"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-39276-ff74d3af",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e941b712e758f615d311946bf98216e79145ccd9",
"digest": {
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
}
}
]