Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix race in buffer_head read fault injection

When I enabled ext4 debug for fault injection testing, I encountered the
following warning:

EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:
Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051
WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0

The root cause of the issue lies in the improper implementation of ext4's
buffer_head read fault injection. The actual completion of buffer_head
read and the buffer_head fault injection are not atomic, which can lead
to the uptodate flag being cleared on normally used buffer_heads in race
conditions.

[CPU0] [CPU1] [CPU2]
ext4_read_inode_bitmap
ext4_read_bh()

ext4_read_inode_bitmap
if (buffer_uptodate(bh))
return bh
jbd2_journal_commit_transaction
__jbd2_journal_refile_buffer
__jbd2_journal_unfile_buffer
__jbd2_journal_temp_unlink_buffer
ext4_simulate_fail_bh()
clear_buffer_uptodate
mark_buffer_dirty

WARN_ON_ONCE(!buffer_uptodate(bh))

The best approach would be to perform fault injection in the IO completion...

Classification

CVE ID: CVE-2024-56686

Affected Products

Vendor: Linux

Product: Linux

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.48% (scored less or equal to compared to others)

EPSS Date: 2025-02-04 (when was this score calculated)

References

https://git.kernel.org/stable/c/77035e4d27e15f87ea55929c8bb8fb1970129e2f
https://git.kernel.org/stable/c/25a5acf88fed59e060405bbb48098f4a3a2c2adc
https://git.kernel.org/stable/c/61832ee7fa2fbd569d129379e795038abfb0d128
https://git.kernel.org/stable/c/2f3d93e210b9c2866c8b3662adae427d5bf511ec

Timeline