CVE-2024-49958

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reserve space for inline xattr before attaching reflink tree

One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn output showed the below corruption

[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record, but fsck believes the largest valid value is 227. Clamp the next record value? n

The stat output from the debugfs.ocfs2 showed the following corruption where the "Next Free Rec:" had overshot the "Count:" in the root metadata block.

    Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)
    FS Generation: 904309833 (0x35e6ac49)
    CRC32: 00000000   ECC: 0000
    Type: Regular   Attr: 0x0   Flags: Valid
    Dynamic Features: (0x16) HasXattr InlineXattr Refcounted
    Extended Attributes Block: 0  Extended Attributes Inline Size: 256
    User: 0 (root)   Group: 0 (root)   Size: 281320357888
    Links: 1   Clusters: 141738
    ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024
    atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024
    mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024
    dtime: 0x0 -- Wed Dec 31 17:00:00 1969
    Refcount Block: 2777346
    Last Extblk: 2886943   Orphan Slot: 0
    Sub Alloc Slot: 0   Sub Alloc Bit: 14
    Tree Depth: 1   Count: 227   Next Free Rec: 230
    ## Offset        Clusters       Block#
    0  0             2310           2776351
    1  2310          2139           2777375
    2  4449          1221           2778399
    3  5670          731            2779423
    4  6401          566            2780447
    .......          ....           .......
    .......          ....           .......

The issue was in the reflink workfow while reserving space...