In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to cover read extent cache access with lock
syzbot reports a f2fs bug as below:
BUG: KASAN: slab-use-after-free in sanitycheckextentcache+0x370/0x410 fs/f2fs/extentcache.c:46 Read of size 4 at addr ffff8880739ab220 by task syz-executor200/5097
CPU: 0 PID: 5097 Comm: syz-executor200 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 sanitycheckextentcache+0x370/0x410 fs/f2fs/extentcache.c:46 doreadinode fs/f2fs/inode.c:509 [inline] f2fsiget+0x33e1/0x46e0 fs/f2fs/inode.c:560 f2fsnfsgetinode+0x74/0x100 fs/f2fs/super.c:3237 genericfhtodentry+0x9f/0xf0 fs/libfs.c:1413 exportfsdecodefhraw+0x152/0x5f0 fs/exportfs/expfs.c:444 exportfsdecodefh+0x3c/0x80 fs/exportfs/expfs.c:584 dohandletopath fs/fhandle.c:155 [inline] handletopath fs/fhandle.c:210 [inline] dohandleopen+0x495/0x650 fs/fhandle.c:226 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf5/0x240 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f
We missed to cover sanitycheckextent_cache() w/ extent cache lock, so, below race case may happen, result in use after free issue.
let's refactor sanitycheckextentcache() to avoid extent cache access and call it before f2fsinitreadextent_tree() to fix this issue.
{ "vanir_signatures": [ { "digest": { "line_hashes": [ "13840438052370249388634555406027405119", "323434497576405781104987776516924612894", "157436603829054142938185572032707432837", "168949780092600390757899363940604455273", "206264427666532935247047146611486686251", "168611200370819870029813925127528958200", "297867715715676204545165403942093414637", "290187147446559625061961877759101478583", "328044584798203944003182871398605317387", "122895415212124731673095203500049412394", "64700336153773825297343386982425803540", "145543188613648474064391782287044119172", "153979248147307338685932322294848558138", "76793214844065691211225097631833710046", "186677812392041039819427279313831746793", "308771786518726345051499344281014690057", "269902494269590701113054615573224455565", "205479682773161650619794562627030802128", "250951406830227723271360059780340039228", "95599246280086993650909523395897143805", "99940233356261739655390361747827647855", "147998934322489168439500360090186280769", "327917825201936728034831647005504199092", "272858201813814374192020357938118026827", "184991891537688794796899233399281452369", "307546410774724765270850726897137378959", "283768908564632083208954045686480154706", "35224495844211355534626797682954360059", "91100397184540481943444052453150018535", "93684783342787473095156018588324140620", "240952902610050343041353135850870365160", "188166759960698108797717940412912856016", "325934838221179369881262537449778371667", "219492253017334697954478076565910112931", "240273131198176679413459927344036042675", "192003609942984659761310894278419859335", "76571851507162500169563569304643853057", "183278031127239426391199883662641227608", "3590043689387678907257264834221096414", "157976856137603038879727474148724361228", "214050516476308522687061355305669420819", "32188795609505756270102067319756044791", "235994348142923733081428122017213383448", "106325629894252140402099406273976262519", "236031277370883220902630030676848392528", "34557805917046784813233552764524082482", "274960437875774792710024407285849293666", "172081028792159513363187705080103066780", "263000798489001562687758390788105948813", "277179721703295988722956010284068613599" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-0eb3c9ba" }, { "digest": { "line_hashes": [ "286932080587250121421051993825100776908", "147460902100254316214373114690103227582", "24033423825950227747398802848816080832", "106934143445031069507097423257133826338" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/f2fs.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-18cede7f" }, { "digest": { "length": 4002.0, "function_hash": "138693844448585821256691790621066369578" }, "target": { "function": "do_read_inode", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-1af60b0f" }, { "digest": { "length": 731.0, "function_hash": "252449734084773574639801671077730525729" }, "target": { "function": "sanity_check_extent_cache", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-1d589dd1" }, { "digest": { "length": 3911.0, "function_hash": "318190798338910271158987454965549100670" }, "target": { "function": "do_read_inode", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-1d956926" }, { "digest": { "line_hashes": [ "34673000177214969033500591089278785973", "135669116606246730627827384667745365805", "296974186968057959505326989525960971261", "209173888922467088949117329876642183120", "81574130754006419435565800095992575352", "128883710629991717639887202390039585598", "85437250106868047744038489441658161482", "302157296722671075034554013328210172458", "113001249516681139104020334135677855220", "282131887407531613866840870819351432968" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-2711c0be" }, { "digest": { "line_hashes": [ "286932080587250121421051993825100776908", "147460902100254316214373114690103227582", "24033423825950227747398802848816080832", "106934143445031069507097423257133826338" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/f2fs.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-30f75b75" }, { "digest": { "length": 696.0, "function_hash": "21543653806259457578768554851566516393" }, "target": { "function": "sanity_check_extent_cache", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-42cf1438" }, { "digest": { "length": 993.0, "function_hash": "85205803724908416378951480242536053420" }, "target": { "function": "f2fs_init_read_extent_tree", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-6d30275b" }, { "digest": { "length": 3911.0, "function_hash": "318190798338910271158987454965549100670" }, "target": { "function": "do_read_inode", "file": "fs/f2fs/inode.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-89e7de74" }, { "digest": { "line_hashes": [ "13840438052370249388634555406027405119", "323434497576405781104987776516924612894", "157436603829054142938185572032707432837", "168949780092600390757899363940604455273", "206264427666532935247047146611486686251", "168611200370819870029813925127528958200", "297867715715676204545165403942093414637", "290187147446559625061961877759101478583", "328044584798203944003182871398605317387", "122895415212124731673095203500049412394", "64700336153773825297343386982425803540", "145543188613648474064391782287044119172", "153979248147307338685932322294848558138", "76793214844065691211225097631833710046", "186677812392041039819427279313831746793", "308771786518726345051499344281014690057", "269902494269590701113054615573224455565", "205479682773161650619794562627030802128", "250951406830227723271360059780340039228", "281180308372883840001773996366060151108", "93641147899645332879189010723904417382", "128870394156208662443541748793764543035", "284461613042480736788927482875451614777", "327917825201936728034831647005504199092", "272858201813814374192020357938118026827", "184991891537688794796899233399281452369", "307546410774724765270850726897137378959", "283768908564632083208954045686480154706", "35224495844211355534626797682954360059", "91100397184540481943444052453150018535", "93684783342787473095156018588324140620", "240952902610050343041353135850870365160", "188166759960698108797717940412912856016", "325934838221179369881262537449778371667", "219492253017334697954478076565910112931", "240273131198176679413459927344036042675", "192003609942984659761310894278419859335", "76571851507162500169563569304643853057", "183278031127239426391199883662641227608", "3590043689387678907257264834221096414", "157976856137603038879727474148724361228", "214050516476308522687061355305669420819", "32188795609505756270102067319756044791", "235994348142923733081428122017213383448", "106325629894252140402099406273976262519", "236031277370883220902630030676848392528", "34557805917046784813233552764524082482", "274960437875774792710024407285849293666", "172081028792159513363187705080103066780", "263000798489001562687758390788105948813", "277179721703295988722956010284068613599" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-95e28962" }, { "digest": { "length": 993.0, "function_hash": "85205803724908416378951480242536053420" }, "target": { "function": "f2fs_init_read_extent_tree", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-98b69dfe" }, { "digest": { "length": 993.0, "function_hash": "85205803724908416378951480242536053420" }, "target": { "function": "f2fs_init_read_extent_tree", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@263df78166d3a9609b97d28c34029bd01874cbb8", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-aa6ee115" }, { "digest": { "line_hashes": [ "286932080587250121421051993825100776908", "147460902100254316214373114690103227582", "24033423825950227747398802848816080832", "106934143445031069507097423257133826338" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/f2fs.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-bef41dc7" }, { "digest": { "line_hashes": [ "13840438052370249388634555406027405119", "323434497576405781104987776516924612894", "157436603829054142938185572032707432837", "168949780092600390757899363940604455273", "206264427666532935247047146611486686251", "168611200370819870029813925127528958200", "297867715715676204545165403942093414637", "290187147446559625061961877759101478583", "328044584798203944003182871398605317387", "122895415212124731673095203500049412394", "64700336153773825297343386982425803540", "145543188613648474064391782287044119172", "153979248147307338685932322294848558138", "76793214844065691211225097631833710046", "186677812392041039819427279313831746793", "308771786518726345051499344281014690057", "269902494269590701113054615573224455565", "205479682773161650619794562627030802128", "250951406830227723271360059780340039228", "95599246280086993650909523395897143805", "99940233356261739655390361747827647855", "147998934322489168439500360090186280769", "327917825201936728034831647005504199092", "272858201813814374192020357938118026827", "184991891537688794796899233399281452369", "307546410774724765270850726897137378959", "283768908564632083208954045686480154706", "35224495844211355534626797682954360059", "91100397184540481943444052453150018535", "93684783342787473095156018588324140620", "240952902610050343041353135850870365160", "188166759960698108797717940412912856016", "325934838221179369881262537449778371667", "219492253017334697954478076565910112931", "240273131198176679413459927344036042675", "192003609942984659761310894278419859335", "76571851507162500169563569304643853057", "183278031127239426391199883662641227608", "3590043689387678907257264834221096414", "157976856137603038879727474148724361228", "214050516476308522687061355305669420819", "32188795609505756270102067319756044791", "235994348142923733081428122017213383448", "106325629894252140402099406273976262519", "236031277370883220902630030676848392528", "34557805917046784813233552764524082482", "274960437875774792710024407285849293666", "172081028792159513363187705080103066780", "263000798489001562687758390788105948813", "277179721703295988722956010284068613599" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-d0f63eb0" }, { "digest": { "line_hashes": [ "34673000177214969033500591089278785973", "135669116606246730627827384667745365805", "296974186968057959505326989525960971261", "209173888922467088949117329876642183120", "81574130754006419435565800095992575352", "128883710629991717639887202390039585598", "85437250106868047744038489441658161482", "302157296722671075034554013328210172458", "113001249516681139104020334135677855220", "282131887407531613866840870819351432968" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@323ef20b5558b9d9fd10c1224327af6f11a8177d", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-e8b3a7ca" }, { "digest": { "line_hashes": [ "34673000177214969033500591089278785973", "135669116606246730627827384667745365805", "296974186968057959505326989525960971261", "209173888922467088949117329876642183120", "81574130754006419435565800095992575352", "128883710629991717639887202390039585598", "85437250106868047744038489441658161482", "302157296722671075034554013328210172458", "113001249516681139104020334135677855220", "282131887407531613866840870819351432968" ], "threshold": 0.9 }, "target": { "file": "fs/f2fs/inode.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-e96b723f" }, { "digest": { "length": 696.0, "function_hash": "21543653806259457578768554851566516393" }, "target": { "function": "sanity_check_extent_cache", "file": "fs/f2fs/extent_cache.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7409b05a64f212735f0d33f5f1602051a886eab", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-44941-efe8e08f" } ] }