In the Linux kernel, the following vulnerability has been resolved:
f2fs: assign CURSEGALLDATA_ATGC if blkaddr is valid
mkdir /mnt/test/comp f2fs_io setflags compression /mnt/test/comp dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile
In the above scenario, we can get a BUGON. kernel BUG at fs/f2fs/segment.c:3589! Call Trace: dowritepage+0x78/0x390 [f2fs] f2fsoutplacewritedata+0x62/0xb0 [f2fs] f2fsdowritedatapage+0x275/0x740 [f2fs] f2fswritesingledatapage+0x1dc/0x8f0 [f2fs] f2fswritemultipages+0x1e5/0xae0 [f2fs] f2fswritecachepages+0xab1/0xc60 [f2fs] f2fswritedatapages+0x2d8/0x330 [f2fs] dowritepages+0xcf/0x270 _writebacksingleinode+0x44/0x350 writebacksbinodes+0x242/0x530 _writebackinodeswb+0x54/0xf0 wbwriteback+0x192/0x310 wbworkfn+0x30d/0x400
The reason is we gave CURSEGALLDATAATGC to COMPRADDR where the page was set the gcing flag by setclusterdirty().
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 822.0,
"function_hash": "88977112733637056709508757940669095843"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd057160ab240dd816ae09b625395d54c297de1",
"target": {
"file": "fs/f2fs/segment.c",
"function": "__get_segment_type_6"
},
"id": "CVE-2024-42273-0b80ecf9"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 924.0,
"function_hash": "303791715996742467600473351099454069562"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4239571c5db46a42f723b8fa8394039187c34439",
"target": {
"file": "fs/f2fs/segment.c",
"function": "__get_segment_type_6"
},
"id": "CVE-2024-42273-1028c3f1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"283966139675863450036805974927829462556",
"71562053496790881221481765350680329360",
"273866635752187818320626001356156249060",
"315756407465766403727816550112936743160"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd057160ab240dd816ae09b625395d54c297de1",
"target": {
"file": "fs/f2fs/segment.c"
},
"id": "CVE-2024-42273-3fcd3120"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 943.0,
"function_hash": "127756913304103310842677199886103860940"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cd106612396656d6f1ca17ef192c6759bb60791",
"target": {
"file": "fs/f2fs/segment.c",
"function": "__get_segment_type_6"
},
"id": "CVE-2024-42273-a474c1e2"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"283966139675863450036805974927829462556",
"71562053496790881221481765350680329360",
"273866635752187818320626001356156249060",
"315756407465766403727816550112936743160"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cd106612396656d6f1ca17ef192c6759bb60791",
"target": {
"file": "fs/f2fs/segment.c"
},
"id": "CVE-2024-42273-dde32f6b"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"283966139675863450036805974927829462556",
"71562053496790881221481765350680329360",
"273866635752187818320626001356156249060",
"315756407465766403727816550112936743160"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4239571c5db46a42f723b8fa8394039187c34439",
"target": {
"file": "fs/f2fs/segment.c"
},
"id": "CVE-2024-42273-fb50a5d6"
}
]