CVE-2022-49352

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix warning in ext4handleinode_extension

We got issue as follows: EXT4-fs error (device loop0) in ext4reserveinodewrite:5741: Out of memory EXT4-fs error (device loop0): ext4setattr:5462: inode #13: comm syz-executor.0: markinodedirty error EXT4-fs error (device loop0) in ext4setattr:5519: Out of memory EXT4-fs error (device loop0): ext4indmapblocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4filewriteiter+0x11c9/0x1220 Modules linked in: CPU: 1 PID: 4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1 RIP: 0010:ext4filewriteiter+0x11c9/0x1220 RSP: 0018:ffff924d80b27c00 EFLAGS: 00010282 RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000 RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd RBP: 000000000000000d R08: ffffffffbc5a2c6b R09: 0000902e0e52a96f R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b FS: 00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: doiterreadvwritev+0x2e5/0x360 doiterwrite+0x112/0x4c0 dopwritev+0x1e5/0x390 _x64syspwritev2+0x7e/0xa0 dosyscall64+0x37/0x50 entrySYSCALL64after_hwframe+0x44/0xa9

Above issue may happen as follows: Assume inode.isize=4096 EXT4I(inode)->i_disksize=4096

step 1: set inode->iisize = 8192 ext4setattr if (attr->iasize != inode->isize) EXT4I(inode)->idisksize = attr->iasize; rc = ext4markinodedirty ext4reserveinodewrite ext4getinodeloc _ext4getinodeloc sbgetblk --> return -ENOMEM ... if (!error) ->will not update isize isizewrite(inode, attr->iasize); Now: inode.isize=4096 EXT4I(inode)->idisksize=8192

step 2: Direct write 4096 bytes ext4filewriteiter ext4diowriteiter iomapdiorw ->return error if (extend) ext4handleinodeextension WARNONONCE(isizeread(inode) < EXT4I(inode)->i_disksize); ->Then trigger warning.

To solve above issue, if mark inode dirty failed in ext4setattr just set 'EXT4I(inode)->i_disksize' with old value.