In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on iextraisize in is_alive()
syzbot found a f2fs bug:
BUG: KASAN: slab-out-of-bounds in datablkaddr fs/f2fs/f2fs.h:2891 [inline] BUG: KASAN: slab-out-of-bounds in isalive fs/f2fs/gc.c:1117 [inline] BUG: KASAN: slab-out-of-bounds in gcdatasegment fs/f2fs/gc.c:1520 [inline] BUG: KASAN: slab-out-of-bounds in dogarbagecollect+0x386a/0x3df0 fs/f2fs/gc.c:1734 Read of size 4 at addr ffff888076557568 by task kworker/u4:3/52
CPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wbworkfn (flush-7:0) Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:284 [inline] printreport+0x15e/0x45d mm/kasan/report.c:395 kasanreport+0xbb/0x1f0 mm/kasan/report.c:495 datablkaddr fs/f2fs/f2fs.h:2891 [inline] isalive fs/f2fs/gc.c:1117 [inline] gcdatasegment fs/f2fs/gc.c:1520 [inline] dogarbagecollect+0x386a/0x3df0 fs/f2fs/gc.c:1734 f2fsgc+0x88c/0x20a0 fs/f2fs/gc.c:1831 f2fsbalancefs+0x544/0x6b0 fs/f2fs/segment.c:410 f2fswriteinode+0x57e/0xe20 fs/f2fs/inode.c:753 writeinode fs/fs-writeback.c:1440 [inline] _writebacksingleinode+0xcfc/0x1440 fs/fs-writeback.c:1652 writebacksbinodes+0x54d/0xf90 fs/fs-writeback.c:1870 wbwriteback+0x2c5/0xd70 fs/fs-writeback.c:2044 wbdowriteback fs/fs-writeback.c:2187 [inline] wbworkfn+0x2dc/0x12f0 fs/fs-writeback.c:2227 processonework+0x9bf/0x1710 kernel/workqueue.c:2289 workerthread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:306
The root cause is that we forgot to do sanity check on .iextraisize in below path, result in accessing invalid address later, fix it. - gcdatasegment - isalive - datablkaddr - offsetinaddr
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b7b4afd6b2c344eabf9cc26b8bfa903c164c7c",
"deprecated": false,
"digest": {
"function_hash": "7269981469208083162803956721481378346",
"length": 1455.0
},
"target": {
"function": "is_alive",
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-3699b734",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5142a4935c1f15841d06047b8130078fc4d7b8f",
"deprecated": false,
"digest": {
"line_hashes": [
"115450002054734702425648726389850692695",
"57425952403796569952367801358807541236",
"178321956183724581099027863236291345108",
"49614217950145336603763274714197264189",
"222478942920057996286273425561534317958",
"283586258703665744293301069374077009528",
"262528374006528937075822014764990675327",
"224603199878451098947983688270126327078",
"80701723791269507691198349290644969032",
"2539689391589697696182507454558072248",
"162857262661811189319422498952975709255",
"206680435694263615007216412622752762032"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-449ebad3",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97ccfffcc061e54ce87e4a51a40e2e9cb0b7076a",
"deprecated": false,
"digest": {
"line_hashes": [
"115450002054734702425648726389850692695",
"57425952403796569952367801358807541236",
"178321956183724581099027863236291345108",
"49614217950145336603763274714197264189",
"222478942920057996286273425561534317958",
"283586258703665744293301069374077009528",
"262528374006528937075822014764990675327",
"224603199878451098947983688270126327078",
"80701723791269507691198349290644969032",
"2539689391589697696182507454558072248",
"162857262661811189319422498952975709255",
"206680435694263615007216412622752762032"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-7f565cf2",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b25035fb888cb2f78bf0b9c9f95b1dc54480d36",
"deprecated": false,
"digest": {
"line_hashes": [
"115450002054734702425648726389850692695",
"57425952403796569952367801358807541236",
"178321956183724581099027863236291345108",
"49614217950145336603763274714197264189",
"222478942920057996286273425561534317958",
"283586258703665744293301069374077009528",
"262528374006528937075822014764990675327",
"224603199878451098947983688270126327078",
"80701723791269507691198349290644969032",
"2539689391589697696182507454558072248",
"162857262661811189319422498952975709255",
"206680435694263615007216412622752762032"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-850c4e6c",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5142a4935c1f15841d06047b8130078fc4d7b8f",
"deprecated": false,
"digest": {
"function_hash": "270983918760347498809507038979939028853",
"length": 1437.0
},
"target": {
"function": "is_alive",
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-ab1be342",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@914e38f02a490dafd980ff0f39cccedc074deb29",
"deprecated": false,
"digest": {
"line_hashes": [
"115450002054734702425648726389850692695",
"57425952403796569952367801358807541236",
"178321956183724581099027863236291345108",
"49614217950145336603763274714197264189",
"222478942920057996286273425561534317958",
"283586258703665744293301069374077009528",
"262528374006528937075822014764990675327",
"224603199878451098947983688270126327078",
"80701723791269507691198349290644969032",
"2539689391589697696182507454558072248",
"162857262661811189319422498952975709255",
"206680435694263615007216412622752762032"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-aba2763f",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b7b4afd6b2c344eabf9cc26b8bfa903c164c7c",
"deprecated": false,
"digest": {
"line_hashes": [
"115450002054734702425648726389850692695",
"57425952403796569952367801358807541236",
"178321956183724581099027863236291345108",
"49614217950145336603763274714197264189",
"222478942920057996286273425561534317958",
"283586258703665744293301069374077009528",
"262528374006528937075822014764990675327",
"224603199878451098947983688270126327078",
"80701723791269507691198349290644969032",
"2539689391589697696182507454558072248",
"162857262661811189319422498952975709255",
"206680435694263615007216412622752762032"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-b0acaca0",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b25035fb888cb2f78bf0b9c9f95b1dc54480d36",
"deprecated": false,
"digest": {
"function_hash": "7269981469208083162803956721481378346",
"length": 1455.0
},
"target": {
"function": "is_alive",
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-b73c6d99",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97ccfffcc061e54ce87e4a51a40e2e9cb0b7076a",
"deprecated": false,
"digest": {
"function_hash": "268962116039832718616005821525932872215",
"length": 1447.0
},
"target": {
"function": "is_alive",
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-d0292f95",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@914e38f02a490dafd980ff0f39cccedc074deb29",
"deprecated": false,
"digest": {
"function_hash": "270983918760347498809507038979939028853",
"length": 1437.0
},
"target": {
"function": "is_alive",
"file": "fs/f2fs/gc.c"
},
"id": "CVE-2022-49738-d34e9ae7",
"signature_version": "v1",
"signature_type": "Function"
}
]