CVE-2022-48631

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug in extents parsing when ehentries == 0 and ehdepth > 0

When walking through an inode extents, the ext4extbinsearchidx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->ehentries) is non-zero when depth is > 0. And this will lead to problems because the EXTFIRSTINDEX() and EXTLASTINDEX() will return garbage and result in this:

[ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4extmapblocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] <TASK> [ 135.279247] ? preemptcountadd+0x6d/0xa0 [ 135.280358] ? percpucounteraddbatch+0x55/0xb0 [ 135.281612] ? rawreadunlock+0x18/0x30 [ 135.282704] ext4mapblocks+0x294/0x5a0 [ 135.283745] ? xaload+0x6f/0xa0 [ 135.284562] ext4mpagereadpages+0x3d6/0x770 [ 135.285646] readpages+0x67/0x1d0 [ 135.286492] ? folioaddlru+0x51/0x80 [ 135.287441] pagecacheraunbounded+0x124/0x170 [ 135.288510] filemapgetpages+0x23d/0x5a0 [ 135.289457] ? pathopenat+0xa72/0xdd0 [ 135.290332] filemapread+0xbf/0x300 [ 135.291158] ? rawspinlockirqsave+0x17/0x40 [ 135.292192] newsyncread+0x103/0x170 [ 135.293014] vfsread+0x15d/0x180 [ 135.293745] ksysread+0xa1/0xe0 [ 135.294461] dosyscall64+0x3c/0x80 [ 135.295284] entrySYSCALL64afterhwframe+0x46/0xb0

This patch simply adds an extra check in __ext4extcheck(), verifying that ehentries is not 0 when ehdepth is > 0.