CVE-2022-49348

In the Linux kernel, the following vulnerability has been resolved:

ext4: filter out EXT4FCREPLAY from on-disk superblock field s_state

The EXT4FCREPLAY bit in sbi->smountstate is used to indicate that we are in the middle of replay the fast commit journal. This was actually a mistake, since the sbi->smountinfo is initialized from es->sstate. Arguably smountstate is misleadingly named, but the name is historical --- smountstate and sstate dates back to ext2.

What should have been used is the ext4_{set,clear,test}mountflag() inline functions, which sets EXT4MF* bits in sbi->smountflags.

The problem with using EXT4FCREPLAY is that a maliciously corrupted superblock could result in EXT4FCREPLAY getting set in smountstate. This bypasses some sanity checks, and this can trigger a BUG() in ext4escacheextent(). As a easy-to-backport-fix, filter out the EXT4FCREPLAY bit for now. We should eventually transition away from EXT4FCREPLAY to something like EXT4MF_REPLAY.