CVE-2022-49380: f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid f2fsbugon() in decvalidnodecount()
As Yanming reported in bugzilla:
https://bugzilla.kernel.org/showbug.cgi?id=215897
I have encountered a bug in F2FS file system in kernel v5.17.
The kernel should enable CONFIGKASAN=y and CONFIGKASANINLINE=y. You can reproduce the bug by running the following commands:
The kernel message is shown below:
kernel BUG at fs/f2fs/f2fs.h:2511! Call Trace: f2fsremoveinodepage+0x2a2/0x830 f2fsevictinode+0x9b7/0x1510 evict+0x282/0x4e0 dounlinkat+0x33a/0x540 x64sysunlinkat+0x8e/0xd0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x44/0xae
The root cause is: .totalvalidblockcount or .totalvalidnodecount could fuzzed to zero, then once decvalidnodecount() was called, it will cause BUGON(), this patch fixes to print warning info and set SBINEEDFSCK into CP instead of panic.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the failure?
The issue occurs when F2FS valid-block or valid-node accounting has been corrupted or fuzzed to zero and dec_valid_node_count() is subsequently called, such as during inode removal. The reported reproduction used a kernel with CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y enabled.
What is the operational impact if the issue is triggered?
The affected code can reach f2fs_bug_on() and panic the kernel. The fix changes this behavior to emit a warning and record SBI_NEED_FSCK in the checkpoint rather than panic.
What can be done if the fix cannot be deployed immediately?
The provided data identifies filesystem-accounting corruption as the trigger but does not specify a configuration workaround. Systems that encounter the warning state introduced by the fix should treat the filesystem as needing fsck.