Public bug reported:
Kernel: 7.0.0-38-generic (Ubuntu 26.04, linux-image-generic 7.0.0-38.38)
Enabling the ext4 "encrypt" feature with tune2fs on a mounted filesystem
and then writing through an fscrypt v2 policy corrupts kernel memory
("Bad pagetable" oopses, then a fault in aes_xts_encrypt_* under
fscrypt_encrypt_pagecache_blocks <- ext4_bio_write_folio, then panic).
Reproduced in seconds in a plain QEMU VM on an untainted kernel; hit two
bare-metal machines as well. Unmount/remount after tune2fs avoids it.
Reproducer:
truncate -s 4G /root/t.img && mkfs.ext4 -q -F /root/t.img
mkdir -p /mnt/t && mount -o loop /root/t.img /mnt/t
tune2fs -O encrypt "$(findmnt -n -o SOURCE /mnt/t)" # no remount
mkdir /mnt/t/enc # then add a v2 key + v2 policy, e.g. fscryptctl
dd if=/dev/zero of=/mnt/t/enc/z bs=16M count=64 conv=fsync
Upstream (Eric Biggers, linux-ext4/linux-fscrypt, 2026-10-25) says this
is fixed in 7.2 by "ext4: don't enable large folios on encrypted inodes":
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-7.2.y&id=40554d1221e3d2ff2e0d192b74a05d89eb3620e7
7.0 upstream is EOL, so please carry this fix in the Ubuntu 7.0 kernel.
The 7.0.0-38 changelog does not include it.
Full oops logs (pstore, two machines) available on request.
Environment:
/proc/version_signature: Ubuntu 7.0.0-38.38-generic 7.0.14
Release: Ubuntu 26.04.1 LTS
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
e2fsprogs: 1.47.2
Expected: writes through an fscrypt policy work normally (as they do
after an unmount/remount following tune2fs -O encrypt).
Actual: kernel memory corruption within seconds, then panic.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172194
Title:
ext4/fscrypt memory corruption after online "tune2fs -O encrypt" —
please backport "ext4: don't enable large folios on encrypted inodes"
(7.0.0-38)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172194/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
