In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to don't dirty inode for readonly filesystem
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fsevictinode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 disposelist fs/inode.c:697 [inline] evictinodes+0x5f8/0x690 fs/inode.c:747 genericshutdownsuper+0x9d/0x2c0 fs/super.c:675 killblocksuper+0x44/0x90 fs/super.c:1667 killf2fssuper+0x303/0x3b0 fs/f2fs/super.c:4894 deactivatelockedsuper+0xc1/0x130 fs/super.c:484 cleanupmnt+0x426/0x4c0 fs/namespace.c:1256 taskworkrun+0x24a/0x300 kernel/taskwork.c:180 ptracenotify+0x2cd/0x380 kernel/signal.c:2399 ptracereportsyscall include/linux/ptrace.h:411 [inline] ptracereportsyscallexit include/linux/ptrace.h:473 [inline] syscallexitwork kernel/entry/common.c:251 [inline] syscallexittousermode_prepare kernel/entry/common.c:278 [inline] _syscallexittousermodework kernel/entry/common.c:283 [inline] syscallexittousermode+0x15c/0x280 kernel/entry/common.c:296 dosyscall64+0x50/0x110 arch/x86/entry/common.c:88 entrySYSCALL64afterhwframe+0x63/0x6b
The root cause is: - dosysopen - f2fs_lookup - _f2fsfindentry - f2fsidepthwrite - f2fsmarkinodedirtysync - f2fsdirtyinode - setinodeflag(inode, FIDIRTYINODE)
When we try to repair icurrentdepth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fsevictinode().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42297.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/inode.c",
"function": "f2fs_mark_inode_dirty_sync"
},
"id": "CVE-2024-42297-2991368e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@192b8fb8d1c8ca3c87366ebbef599fa80bb626b8",
"digest": {
"function_hash": "84971280564172742108495908976622422378",
"length": 164.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/inode.c"
},
"id": "CVE-2024-42297-da120f99",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@192b8fb8d1c8ca3c87366ebbef599fa80bb626b8",
"digest": {
"line_hashes": [
"138298578548532295820476204667540296919",
"270814093984033854015891949004736069348",
"152925148121250213163729704485924165528"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42297.json"