In the Linux kernel, the following vulnerability has been resolved:
ext4: check dot and dotdot of dx_root before making dir indexed
BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> makeindexeddir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4addentry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4rename fs/ext4/namei.c:3936 [inline] ext4rename2+0x26e5/0x4370 fs/ext4/namei.c:4214
The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue.
do_split
unsigned split
dx_make_map
count = 1
split = count/2 = 0;
continued = hash2 == map[split - 1].hash;
---> map[4294967295]
The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called.
But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows:
bus dentry1 hole dentry2 free |xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024
So when renaming dentry1 increases its namelen length by 1, neither hole nor free is sufficient to hold the new dentry, and makeindexed_dir() is called.
In makeindexeddir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1.
Therefore add the ext4checkdx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue.
[
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 3207.0,
"function_hash": "272588905722008836685248624496268355524"
},
"deprecated": false,
"id": "CVE-2024-42305-01937bb7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50ea741def587a64e08879ce6c6a30131f7111e7",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95954410033962780711690266431031750327",
"248484285116310342899581645753009566460",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-05b92fed",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8afe06ed3be7a874b3cd82ef5f8959aca8d6429a",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 2965.0,
"function_hash": "85455835273261157471025195631191907442"
},
"deprecated": false,
"id": "CVE-2024-42305-091ce96b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42d420517072028fb0eb852c358056b7717ba5aa",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 2965.0,
"function_hash": "85455835273261157471025195631191907442"
},
"deprecated": false,
"id": "CVE-2024-42305-2961ef88",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19e13b4d7f0303186fcc891aba8d0de7c8fdbda8",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95954410033962780711690266431031750327",
"248484285116310342899581645753009566460",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-30abba25",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdd345321699042ece4a9d2e70754d2397d378c5",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95954410033962780711690266431031750327",
"248484285116310342899581645753009566460",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-437dc910",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50ea741def587a64e08879ce6c6a30131f7111e7",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 3207.0,
"function_hash": "272588905722008836685248624496268355524"
},
"deprecated": false,
"id": "CVE-2024-42305-53d669b3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdd345321699042ece4a9d2e70754d2397d378c5",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"158703041556993427056181137322867277910",
"169620289564576481255532705110717195204",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-8c46841d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19e13b4d7f0303186fcc891aba8d0de7c8fdbda8",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 3227.0,
"function_hash": "74867582221245289260409924787659619705"
},
"deprecated": false,
"id": "CVE-2024-42305-a2ae3f12",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8afe06ed3be7a874b3cd82ef5f8959aca8d6429a",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"158703041556993427056181137322867277910",
"169620289564576481255532705110717195204",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-adc807ab",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 2833.0,
"function_hash": "23207537679414395738141186518741285451"
},
"deprecated": false,
"id": "CVE-2024-42305-af902bbd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"digest": {
"length": 3227.0,
"function_hash": "74867582221245289260409924787659619705"
},
"deprecated": false,
"id": "CVE-2024-42305-eb758afd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abb411ac991810c0bcbe51c2e76d2502bf611b5c",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95954410033962780711690266431031750327",
"248484285116310342899581645753009566460",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-eda3fdbd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42d420517072028fb0eb852c358056b7717ba5aa",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "fs/ext4/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95954410033962780711690266431031750327",
"248484285116310342899581645753009566460",
"145353662787869530247506544064120387740",
"49683926889764133529727540262803965137",
"192825613813701292747313231605087444529",
"26913797198445571350893296188406854214",
"173207887965537104895605170024411769426",
"75381682756972834455179189320513308375",
"285007439516936091485926434890326871513",
"37618516529788103413186395326217348562",
"322620165465301738222576079697381341518",
"40066686049286913325980713824131721729",
"126591553410258979783984712111669746391",
"131950543742160153470052336452035907101",
"151804377157686375724158840792854007324",
"2741084586368290423539645291291911570"
]
},
"deprecated": false,
"id": "CVE-2024-42305-f704ecf3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abb411ac991810c0bcbe51c2e76d2502bf611b5c",
"signature_version": "v1"
}
]