CVE-2023-53846: f2fs: fix to do sanity check on direct node in truncate_dnode()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on direct node in truncatednode()
syzbot reports below bug:
BUG: KASAN: slab-use-after-free in f2fstruncatedatablocksrange+0x122a/0x14c0 fs/f2fs/file.c:574 Read of size 4 at addr ffff88802a25c000 by task syz-executor148/5000
CPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xd9/0x150 lib/dumpstack.c:106 printaddressdescription.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 printreport mm/kasan/report.c:462 [inline] kasanreport+0x11c/0x130 mm/kasan/report.c:572 f2fstruncatedatablocksrange+0x122a/0x14c0 fs/f2fs/file.c:574 truncatednode+0x229/0x2e0 fs/f2fs/node.c:944 f2fstruncateinodeblocks+0x64b/0xde0 fs/f2fs/node.c:1154 f2fsdotruncateblocks+0x4ac/0xf30 fs/f2fs/file.c:721 f2fstruncateblocks+0x7b/0x300 fs/f2fs/file.c:749 f2fstruncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799 f2fstruncate include/linux/fs.h:825 [inline] f2fssetattr+0x1738/0x2090 fs/f2fs/file.c:1006 notifychange+0xb2c/0x1180 fs/attr.c:483 dotruncate+0x143/0x200 fs/open.c:66 handletruncate fs/namei.c:3295 [inline] doopen fs/namei.c:3640 [inline] pathopenat+0x2083/0x2750 fs/namei.c:3791 dofilpopen+0x1ba/0x410 fs/namei.c:3818 dosysopenat2+0x16d/0x4c0 fs/open.c:1356 dosysopen fs/open.c:1372 [inline] dosyscreat fs/open.c:1448 [inline] sesyscreat fs/open.c:1442 [inline] x64syscreat+0xcd/0x120 fs/open.c:1442 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x39/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
The root cause is, inodeA references inodeB via inodeB's ino, once inodeA is truncated, it calls truncatednode() to truncate data blocks in inodeB's node page, it traverse mapping data from node->i.iaddr[0] to node->i.iaddr[ADDRSPERBLOCK() - 1], result in out-of-boundary access.
This patch fixes to add sanity check on dnode page in truncatednode(), so that, it can help to avoid triggering such issue, and once it encounters such issue, it will record newly introduced ERRORINVALIDNODEREFERENCE error into superblock, later fsck can detect such issue and try repairing.
Also, it removes f2fstruncatedatablocks() for cleanup due to the function has only one caller, and uses f2fstruncatedatablocksrange() instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In f2fs truncate handling, add the sanity check on the dnode page in truncate_dnode() (and direct node) so the filesystem records ERROR_INVALID_NODE_REFERENCE when the problematic node reference is encountered.
f2fs ERROR_INVALID_NODE_REFERENCE = record newly introduced ERROR_INVALID_NODE_REFERENCE instead of risking out-of-boundary access - Compensating control
Run filesystem check/repair (fsck) after the update; the text notes fsck can detect such issues and try repairing after the error is recorded.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53846?
CVE-2023-53846 has a high severity rating due to the potential for a slab-use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2023-53846?
Fix CVE-2023-53846 by updating to the latest Linux kernel version that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-53846?
CVE-2023-53846 specifically affects the Linux kernel version 6.4.0-rc7.
What type of vulnerability is CVE-2023-53846?
CVE-2023-53846 is a memory management vulnerability identified as a slab-use-after-free in the Linux kernel.
What impact does CVE-2023-53846 have on system security?
CVE-2023-53846 can lead to potential arbitrary code execution, compromising system integrity and security.