erofs: handle overlapped pclusters out of crafted images properly
syzbot reported a task hang issue due to a deadlock case where it is
waiting for the folio lock of a cached folio that will be used for
cache I/Os.
After looking into the crafted fuzzed image, I found it's formed with
several overlapped big pclusters as below:
Ext: logical offset | length : physical offset | length
0: 0.. 16384 | 16384 : 151552.. 167936 | 16384
1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384
2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384
...
Here, extent 0/1 are physically overlapped although it's entirely
_impossible_ for normal filesystem images generated by mkfs.
First, managed folios containing compressed data will be marked as
up-to-date and then unlocked immediately (unlike in-place folios) when
compressed I/Os are complete. If physical blocks are not submitted in
the incremental order, there should be separate BIOs to avoid dependency
issues. However, the current code mis-arranges z_erofs_fill_bio_vec()
and BIO submission which causes unexpected BIO waits.
Second, managed folios will be connected to their own pclusters for
efficient inter-queries. However, this is somewhat hard to implement
easily if overlapped big pclusters exist. Again, these only appear in
fuzzed images so let's simply fall back to temporary short-lived pages
for correctness.
Additionally, it justifies that referenced managed folios cannot be
truncated for now and reverts part of commit 2080ca1ed3e4 ("erofs: tidy
up `struct z_erofs_bvec`") for simplicity although it shouldn't be any
difference.
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4561-1 | linux-6.1 security update |
Debian DSA |
DSA-6243-1 | linux security update |
Ubuntu USN |
USN-7276-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7277-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7310-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7513-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7513-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7513-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7513-4 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7513-5 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-7514-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-7515-1 | Linux kernel (GKE) vulnerabilities |
Ubuntu USN |
USN-7515-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7522-1 | Linux kernel (Azure, N-Series) vulnerabilities |
Ubuntu USN |
USN-7523-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
Ubuntu USN |
USN-7524-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Sat, 11 Apr 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 11 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Fri, 17 Jan 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 24 Oct 2024 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-404 | |
| Metrics |
threat_severity
|
threat_severity
|
Wed, 23 Oct 2024 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-667 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
Tue, 22 Oct 2024 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Mon, 21 Oct 2024 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 21 Oct 2024 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: erofs: handle overlapped pclusters out of crafted images properly syzbot reported a task hang issue due to a deadlock case where it is waiting for the folio lock of a cached folio that will be used for cache I/Os. After looking into the crafted fuzzed image, I found it's formed with several overlapped big pclusters as below: Ext: logical offset | length : physical offset | length 0: 0.. 16384 | 16384 : 151552.. 167936 | 16384 1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384 2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384 ... Here, extent 0/1 are physically overlapped although it's entirely _impossible_ for normal filesystem images generated by mkfs. First, managed folios containing compressed data will be marked as up-to-date and then unlocked immediately (unlike in-place folios) when compressed I/Os are complete. If physical blocks are not submitted in the incremental order, there should be separate BIOs to avoid dependency issues. However, the current code mis-arranges z_erofs_fill_bio_vec() and BIO submission which causes unexpected BIO waits. Second, managed folios will be connected to their own pclusters for efficient inter-queries. However, this is somewhat hard to implement easily if overlapped big pclusters exist. Again, these only appear in fuzzed images so let's simply fall back to temporary short-lived pages for correctness. Additionally, it justifies that referenced managed folios cannot be truncated for now and reverts part of commit 2080ca1ed3e4 ("erofs: tidy up `struct z_erofs_bvec`") for simplicity although it shouldn't be any difference. | |
| Title | erofs: handle overlapped pclusters out of crafted images properly | |
| References |
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T20:39:45.456Z
Reserved: 2024-09-30T16:00:12.958Z
Link: CVE-2024-47736
Updated: 2024-10-21T12:59:53.421Z
Status : Modified
Published: 2024-10-21T13:15:03.737
Modified: 2026-04-11T13:16:34.453
Link: CVE-2024-47736
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA
Ubuntu USN