CVE-2022-49380: f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()

Q: What conditions are needed to trigger the failure?

The issue occurs when F2FS valid-block or valid-node accounting has been corrupted or fuzzed to zero and dec_valid_node_count() is subsequently called, such as during inode removal. The reported reproduction used a kernel with CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y enabled.

Q: What is the operational impact if the issue is triggered?

The affected code can reach f2fs_bug_on() and panic the kernel. The fix changes this behavior to emit a warning and record SBI_NEED_FSCK in the checkpoint rather than panic.

Q: What can be done if the fix cannot be deployed immediately?

The provided data identifies filesystem-accounting corruption as the trigger but does not specify a configuration workaround. Systems that encounter the warning state introduced by the fix should treat the filesystem as needing fsck.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid f2fsbugon() in decvalidnodecount()

As Yanming reported in bugzilla:

https://bugzilla.kernel.org/showbug.cgi?id=215897

I have encountered a bug in F2FS file system in kernel v5.17.

The kernel should enable CONFIGKASAN=y and CONFIGKASANINLINE=y. You can reproduce the bug by running the following commands:

The kernel message is shown below:

kernel BUG at fs/f2fs/f2fs.h:2511! Call Trace: f2fsremoveinodepage+0x2a2/0x830 f2fsevictinode+0x9b7/0x1510 evict+0x282/0x4e0 dounlinkat+0x33a/0x540 x64sysunlinkat+0x8e/0xd0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x44/0xae

The root cause is: .totalvalidblockcount or .totalvalidnodecount could fuzzed to zero, then once decvalidnodecount() was called, it will cause BUGON(), this patch fixes to print warning info and set SBINEEDFSCK into CP instead of panic.

Affected Software

6 affected components

Linux Kernel

Linux Linux kernel>=3.8<5.4.198

Linux Linux kernel>=5.5<5.10.121

Linux Linux kernel>=5.11<5.15.46

Linux Linux kernel>=5.16<5.17.14

Linux Linux kernel>=5.18<5.18.3

Event History

Feb 26, 2025

CVE Published

via MITRE·02:11 AM

Data Sourced

via MITRE·02:11 AM

Description

Data Sourced

via NVD·07:01 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are needed to trigger the failure?

The issue occurs when F2FS valid-block or valid-node accounting has been corrupted or fuzzed to zero and dec_valid_node_count() is subsequently called, such as during inode removal. The reported reproduction used a kernel with CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y enabled.

What is the operational impact if the issue is triggered?

The affected code can reach f2fs_bug_on() and panic the kernel. The fix changes this behavior to emit a warning and record SBI_NEED_FSCK in the checkpoint rather than panic.

What can be done if the fix cannot be deployed immediately?

The provided data identifies filesystem-accounting corruption as the trigger but does not specify a configuration workaround. Systems that encounter the warning state introduced by the fix should treat the filesystem as needing fsck.

CVE-2022-49380: f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()

Affected Software

Event History

Frequently Asked Questions

What conditions are needed to trigger the failure?

What is the operational impact if the issue is triggered?

What can be done if the fix cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the failure?

What is the operational impact if the issue is triggered?

What can be done if the fix cannot be deployed immediately?