In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to don't dirty inode for readonly filesystem
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fsevictinode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 disposelist fs/inode.c:697 [inline] evictinodes+0x5f8/0x690 fs/inode.c:747 genericshutdownsuper+0x9d/0x2c0 fs/super.c:675 killblocksuper+0x44/0x90 fs/super.c:1667 killf2fssuper+0x303/0x3b0 fs/f2fs/super.c:4894 deactivatelockedsuper+0xc1/0x130 fs/super.c:484 cleanupmnt+0x426/0x4c0 fs/namespace.c:1256 taskworkrun+0x24a/0x300 kernel/taskwork.c:180 ptracenotify+0x2cd/0x380 kernel/signal.c:2399 ptracereportsyscall include/linux/ptrace.h:411 [inline] ptracereportsyscallexit include/linux/ptrace.h:473 [inline] syscallexitwork kernel/entry/common.c:251 [inline] syscallexittousermodeprepare kernel/entry/common.c:278 [inline] _syscallexittousermodework kernel/entry/common.c:283 [inline] syscallexittousermode+0x15c/0x280 kernel/entry/common.c:296 dosyscall64+0x50/0x110 arch/x86/entry/common.c:88 entrySYSCALL64after_hwframe+0x63/0x6b
The root cause is: - dosysopen - f2fslookup - _f2fsfindentry - f2fsidepthwrite - f2fsmarkinodedirtysync - f2fsdirtyinode - setinodeflag(inode, FIDIRTY_INODE)
When we try to repair icurrentdepth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fsevictinode().
{ "vanir_signatures": [ { "signature_version": "v1", "target": { "function": "f2fs_mark_inode_dirty_sync", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54162974aea37a8cae00742470a78c7f6bd6f915", "deprecated": false, "digest": { "length": 164.0, "function_hash": "84971280564172742108495908976622422378" }, "id": "CVE-2024-42297-27f349a3" }, { "signature_version": "v1", "target": { "function": "f2fs_mark_inode_dirty_sync", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@192b8fb8d1c8ca3c87366ebbef599fa80bb626b8", "deprecated": false, "digest": { "length": 164.0, "function_hash": "84971280564172742108495908976622422378" }, "id": "CVE-2024-42297-2991368e" }, { "signature_version": "v1", "target": { "function": "f2fs_mark_inode_dirty_sync", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62ff092a42f4a1bae3b310cf46673b4f3aac3b5", "deprecated": false, "digest": { "length": 164.0, "function_hash": "84971280564172742108495908976622422378" }, "id": "CVE-2024-42297-41942e63" }, { "signature_version": "v1", "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54162974aea37a8cae00742470a78c7f6bd6f915", "deprecated": false, "digest": { "line_hashes": [ "138298578548532295820476204667540296919", "270814093984033854015891949004736069348", "152925148121250213163729704485924165528" ], "threshold": 0.9 }, "id": "CVE-2024-42297-8421ebb4" }, { "signature_version": "v1", "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d2916516577f2239b3377d9e8d12da5e6ccdfcf", "deprecated": false, "digest": { "line_hashes": [ "138298578548532295820476204667540296919", "270814093984033854015891949004736069348", "152925148121250213163729704485924165528" ], "threshold": 0.9 }, "id": "CVE-2024-42297-9055f733" }, { "signature_version": "v1", "target": { "function": "f2fs_mark_inode_dirty_sync", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1", "deprecated": false, "digest": { "length": 164.0, "function_hash": "84971280564172742108495908976622422378" }, "id": "CVE-2024-42297-a0c3598d" }, { "signature_version": "v1", "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1", "deprecated": false, "digest": { "line_hashes": [ "138298578548532295820476204667540296919", "270814093984033854015891949004736069348", "152925148121250213163729704485924165528" ], "threshold": 0.9 }, "id": "CVE-2024-42297-cfb31adb" }, { "signature_version": "v1", "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62ff092a42f4a1bae3b310cf46673b4f3aac3b5", "deprecated": false, "digest": { "line_hashes": [ "138298578548532295820476204667540296919", "270814093984033854015891949004736069348", "152925148121250213163729704485924165528" ], "threshold": 0.9 }, "id": "CVE-2024-42297-d14da95e" }, { "signature_version": "v1", "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@192b8fb8d1c8ca3c87366ebbef599fa80bb626b8", "deprecated": false, "digest": { "line_hashes": [ "138298578548532295820476204667540296919", "270814093984033854015891949004736069348", "152925148121250213163729704485924165528" ], "threshold": 0.9 }, "id": "CVE-2024-42297-da120f99" }, { "signature_version": "v1", "target": { "function": "f2fs_mark_inode_dirty_sync", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d2916516577f2239b3377d9e8d12da5e6ccdfcf", "deprecated": false, "digest": { "length": 164.0, "function_hash": "84971280564172742108495908976622422378" }, "id": "CVE-2024-42297-dd6a945f" } ] }