In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to clear dirty inode in f2fsevictinode()
As Yanming reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215904
The kernel message is shown below:
kernel BUG at fs/f2fs/inode.c:825! Call Trace: evict+0x282/0x4e0 _dentrykill+0x2b2/0x4d0 shrinkdentrylist+0x17c/0x4f0 shrinkdcacheparent+0x143/0x1e0 doonetree+0x9/0x30 shrinkdcacheforumount+0x51/0x120 genericshutdownsuper+0x5c/0x3a0 killblocksuper+0x90/0xd0 killf2fssuper+0x225/0x310 deactivatelockedsuper+0x78/0xc0 cleanupmnt+0x2b7/0x480 taskworkrun+0xc8/0x150 exittousermodeprepare+0x14a/0x150 syscallexittousermode+0x1d/0x40 dosyscall64+0x48/0x90
The root cause is: inode node and dnode node share the same nid, so during f2fsevictinode(), dnode node truncation will invalidate its NAT entry, so when truncating inode node, it fails due to invalid NAT entry, result in inode is still marked as dirty, fix this issue by clearing dirty for inode and setting SBINEEDFSCK flag in filesystem.
output from dump.f2fs: [printnodeinfo: 354] Node ID [0xf:15] is inode i_nid[0] [0x f : 15]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49364.json"
}