Re: CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors

[Baokun Li]

On 2024/12/30 16:33, Greg KH wrote:
> On Mon, Dec 30, 2024 at 04:21:00PM +0800, Baokun Li wrote:
> > On 2024/12/30 15:54, Greg KH wrote:
> > > On Mon, Dec 30, 2024 at 03:27:45PM +0800, Baokun Li wrote:
> > > > > Description
> > > > > ===========
> > > > >
> > > > > In the Linux kernel, the following vulnerability has been resolved:
> > > > >
> > > > > ext4: don't set SB_RDONLY after filesystem errors
> > > > >
> > > > > When the filesystem is mounted with errors=remount-ro, we were setting
> > > > > SB_RDONLY flag to stop all filesystem modifications. We knew this misses
> > > > > proper locking (sb->s_umount) and does not go through proper filesystem
> > > > > remount procedure but it has been the way this worked since early ext2
> > > > > days and it was good enough for catastrophic situation damage
> > > > > mitigation. Recently, syzbot has found a way (see link) to trigger
> > > > > warnings in filesystem freezing because the code got confused by
> > > > > SB_RDONLY changing under its hands. Since these days we set
> > > > > EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all
> > > > > filesystem modifications, modifying SB_RDONLY shouldn't be needed. So
> > > > > stop doing that.
> > > > >
> > > > > The Linux kernel CVE team has assigned CVE-2024-50191 to this issue.
> > > > >
> > > > >
> > > > > Affected and fixed versions
> > > > > ===========================
> > > > >
> > > > >       Fixed in 5.15.168 with commit fbb177bc1d64
> > > > >       Fixed in 6.1.113 with commit 4061e07f040a
> > > > Since 6.1 and 5.15 don't have backport
> > > >       commit 95257987a638 ("ext4: drop EXT4_MF_FS_ABORTED flag"),
> > > > we won't set the EXT4_FLAGS_SHUTDOWN bit in ext4_handle_error() yet. So
> > > > here these two commits cause us to repeatedly get the following printout:
> > > >
> > > > [   42.993195] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993351] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993483] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993597] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993638] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993718] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993866] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993874] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.993874] EXT4-fs error (device sda) in __ext4_new_inode:1089: Journal
> > > > has aborted
> > > > [   42.994059] EXT4-fs error (device sda): ext4_journal_check_start:83: comm
> > > > fsstress: Detected aborted journal
> > > > [   42.999893] EXT4-fs: 58002 callbacks suppressed
> > > > [   42.999895] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000110] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000274] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000421] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000569] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000701] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.000869] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.001094] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.001229] EXT4-fs (sda): Remounting filesystem read-only
> > > > [   43.001365] EXT4-fs (sda): Remounting filesystem read-only
> > > >
> > > > Perhaps we should revert both commits.
> > > Maybe, if so, please send the needed info to the stable list with the
> > > backports that have been tested.  cve@xxxxxxxxxx isn't the place for
> > > this :)
> > I replied to this thread on lore, which automatically CC's cve@xxxxxxxxxx.
> Yes, which is fine, but you are responding to a CVE report, NOT to a
> stable kernel patch that has been backported, which is what I think you
> want to respond to, right?
Actually, we discovered the mechanism change introduced by its fix patch
while analyzing CVE-2024-50191.
https://lore.kernel.org/linux-ext4/22d652f6-cb3c-43f5-b2fe-0a4bb6516a04@xxxxxxxxxx/T/#u

However, the situation is worse for 5.15 and 6.1, as the patch upon which
the fix depends has not even been merged yet. Therefore, I am replying here
to prevent the erroneous information from further propagating with the CVE.
> > We don't use these two versions, we just happened to find the issue.
> > If you feel that reporting issue is bothering you, then I won't do it.🙂
> It's fine, I'm just trying to get you to route it to a group of people
> that can do something about it.  Again, try responding to the stable
> patch that was merged there, that would be better, along with perhaps
> providing a patch showing what you feel should be done.
The problem I've reported to the ext4 mail list, and perhaps some patches
will be synchronized to stable if anything comes of the discussion in the
link above.
> If patches that are assigned CVEs later get reverted, the CVEs should
> semi-automatically be rejected (I swept the CVE tree for this last
> week), so you don't need to worry about that happening.
Thank you for your maintenance!

This CVE is indeed a problem, so it's not necessary to reject it.
What I can say for sure now is that the 5.15 and 6.1 fixes are problematic.
The final solution needs some more discussion.


Regards,
Baokun