kernel BUG in ext4_ext_try_to_merge

[Ubisectech Sirius]

Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.8. Attached to the email were a PoC file of the issue.

Stack dump:

EXT4-fs error (device loop2) in ext4_reserve_inode_write:5738: Out of memory
EXT4-fs error (device loop2): ext4_ext_grow_indepth:1386: inode #18: comm syz.2.510: mark_inode_dirty error
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:1898!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 17034 Comm: syz.2.510 Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_ext_try_to_merge+0x5cc/0x730 fs/ext4/extents.c:1898
Code: 89 de 48 89 ef e8 74 f6 ff ff 31 ff 41 89 c5 89 c6 e8 48 f2 5f ff 45 85 ed 0f 84 df fa ff ff e9 ed fa ff ff e8 95 f6 5f ff 90 <0f> 0b e8 ed b9 b7 ff e9 78 fa ff ff 4c 89 ef e8 e0 b9 b7 ff e9 f8
RSP: 0018:ffffc900029a6fe0 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff88801e67f180 RCX: ffffc90003b39000
RDX: 0000000000040000 RSI: ffffffff822ab61b RDI: ffff88801e67f1d0
RBP: ffff88804e68dcb0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88804e68da18 R15: ffff88804e68dcb0
FS:  00007f3e3f11d640(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e3f0daff8 CR3: 0000000017974000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
PKRU: 55555554
Call Trace:
 <TASK>
 ext4_split_extent_at+0x70d/0xdd0 fs/ext4/extents.c:3262
 ext4_split_extent+0x21f/0x530 fs/ext4/extents.c:3330
 ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3850 [inline]
 ext4_ext_map_blocks+0x308a/0x58f0 fs/ext4/extents.c:4208
 ext4_map_blocks+0x763/0x1750 fs/ext4/inode.c:623
 mpage_map_one_extent fs/ext4/inode.c:2163 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2216 [inline]
 ext4_do_writepages+0x173f/0x30f0 fs/ext4/inode.c:2679
 ext4_writepages+0x30c/0x780 fs/ext4/inode.c:2768
 do_writepages+0x1a8/0x640 mm/page-writeback.c:2553
 filemap_fdatawrite_wbc mm/filemap.c:388 [inline]
 filemap_fdatawrite_wbc+0x14b/0x1b0 mm/filemap.c:378
 __filemap_fdatawrite_range+0xb8/0x100 mm/filemap.c:421
 file_write_and_wait_range+0xd2/0x140 mm/filemap.c:779
 generic_buffers_fsync_noflush+0x7d/0x380 fs/buffer.c:602
 ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
 ext4_sync_file+0x5c6/0xe70 fs/ext4/fsync.c:151
 vfs_fsync_range+0x144/0x230 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2734 [inline]
 generic_write_sync include/linux/fs.h:2731 [inline]
 ext4_buffered_write_iter+0x2e4/0x3d0 fs/ext4/file.c:305
 ext4_file_write_iter+0x8dd/0x18b0 fs/ext4/file.c:698
 call_write_iter include/linux/fs.h:2087 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0xbde/0x1090 fs/read_write.c:590
 ksys_write+0x122/0x250 fs/read_write.c:643
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f3e3e3958cd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3e3f11cfa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3e3e533f60 RCX: 00007f3e3e3958cd
RDX: 00000000fffffea1 RSI: 00000000200002c0 RDI: 0000000000000009
RBP: 00007f3e3e41bb06 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f3e3e533f60 R15: 00007f3e3f0fd000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_ext_try_to_merge+0x5cc/0x730 fs/ext4/extents.c:1898
Code: 89 de 48 89 ef e8 74 f6 ff ff 31 ff 41 89 c5 89 c6 e8 48 f2 5f ff 45 85 ed 0f 84 df fa ff ff e9 ed fa ff ff e8 95 f6 5f ff 90 <0f> 0b e8 ed b9 b7 ff e9 78 fa ff ff 4c 89 ef e8 e0 b9 b7 ff e9 f8
RSP: 0018:ffffc900029a6fe0 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff88801e67f180 RCX: ffffc90003b39000
RDX: 0000000000040000 RSI: ffffffff822ab61b RDI: ffff88801e67f1d0
RBP: ffff88804e68dcb0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88804e68da18 R15: ffff88804e68dcb0
FS:  00007f3e3f11d640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055998f97d5a0 CR3: 0000000017974000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554

Thank you for taking the time to read this email and we look forward to working with you further.

Attachment: poc.c
Description: Binary data