CVE-2022-49174

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix ext4mbmarkbb() with flexbg with fast_commit

In case of flexbg feature (which is by default enabled), extents for any given inode might span across blocks from two different block group. ext4mbmarkbb() only reads the bufferhead of block bitmap once for the starting block group, but it fails to read it again when the extent length boundary overflows to another block group. Then in this below loop it accesses memory beyond the block group bitmap bufferhead and results into a data abort.

for (i = 0; i < clen; i++)
    if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)
        already++;

This patch adds this functionality for checking block group boundary in ext4mbmarkbb() and update the bufferhead(bitmap_bh) for every different block group.

w/o this patch, I was easily able to hit a data access abort using Power platform.

<...> [ 74.327662] EXT4-fs error (device loop3): ext4mbgeneratebuddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters [ 74.533214] EXT4-fs (loop3): shut down requested (2) [ 74.536705] Aborting journal on device loop3-8. [ 74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000 [ 74.703727] Faulting instruction address: 0xc0000000007bffb8 cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060] pc: c0000000007bffb8: ext4mbmarkbb+0x198/0x5a0 lr: c0000000007bfeec: ext4mbmarkbb+0xcc/0x5a0 sp: c000000015db7300 msr: 800000000280b033 dar: c00000005e980000 dsisr: 40000000 current = 0xc000000027af6880 paca = 0xc00000003ffd5200 irqmask: 0x03 irqhappened: 0x01 pid = 5167, comm = mount <...> enter ? for help [c000000015db7380] c000000000782708 ext4extclearbb+0x378/0x410 [c000000015db7400] c000000000813f14 ext4fcreplay+0x1794/0x2000 [c000000015db7580] c000000000833f7c doonepass+0xe9c/0x12a0 [c000000015db7710] c000000000834504 jbd2journalrecover+0x184/0x2d0 [c000000015db77c0] c000000000841398 jbd2journalload+0x188/0x4a0 [c000000015db7880] c000000000804de8 ext4fillsuper+0x2638/0x3e10 [c000000015db7a40] c0000000005f8404 gettreebdev+0x2b4/0x350 [c000000015db7ae0] c0000000007ef058 ext4gettree+0x28/0x40 [c000000015db7b00] c0000000005f6344 vfsgettree+0x44/0x100 [c000000015db7b70] c00000000063c408 pathmount+0xdd8/0xe70 [c000000015db7c40] c00000000063c8f0 sysmount+0x450/0x550 [c000000015db7d50] c000000000035770 systemcallexception+0x4a0/0x4e0 [c000000015db7e10] c00000000000c74c systemcall_common+0xec/0x250