CVE-2023-54153

In the Linux kernel, the following vulnerability has been resolved:

ext4: turn quotas off if mount failed after enabling quotas

Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:

================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90

To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.

A low-severity memory leak was found in the ext4 filesystem code of the Linux kernel as shipped in Red Hat Enterprise Linux 9. When an ext4 filesystem is mounted with quotas enabled and ext4_mark_recovery_complete() returns an error, the mount error-handling path exits without turning the enabled quotas off, leaving quota-related kernel memory allocations unreferenced, as reported by kmemleak. Triggering this issue requires local access and privileges sufficient to perform a mount, and each failed mount leaks only a small amount of kernel memory, with no impact on confidentiality or integrity and only low availability impact. Red Hat therefore rates this flaw Low severity (CVSS 3.3), a meaningful difference from the 7.8 (Important) score in the upstream CVE record, whose generic vector does not reflect the constrained, error-path nature of this leak. For Red Hat Enterprise Linux 9 kernel and kernel-rt, the fix is deferred because the issue is a minor resource leak in a rarely hit mount error path rather than a memory-corruption or privilege-escalation bug, and it may be addressed in a future update; the residual risk is limited, gradual kernel memory consumption on systems that repeatedly attempt failing quota-enabled mounts. Red Hat Enterprise Linux 7, 8, and 10 and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those streams, and Red Hat Enterprise Linux 6 is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.