In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to truncate preallocated blocks in f2fsfileopen()
chenyuwen reports a f2fs bug as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011 fscryptsetbiocryptctx+0x78/0x1e8 f2fsgrabreadbio+0x78/0x208 f2fssubmitpageread+0x44/0x154 f2fsgetreaddatapage+0x288/0x5f4 f2fsgetlockdatapage+0x60/0x190 truncatepartialdatapage+0x108/0x4fc f2fsdotruncateblocks+0x344/0x5f0 f2fstruncateblocks+0x6c/0x134 f2fstruncate+0xd8/0x200 f2fsiget+0x20c/0x5ac dogarbagecollect+0x5d0/0xf6c f2fsgc+0x22c/0x6a4 f2fsdisablecheckpoint+0xc8/0x310 f2fsfillsuper+0x14bc/0x1764 mountbdev+0x1b4/0x21c f2fsmount+0x20/0x30 legacygettree+0x50/0xbc vfsgettree+0x5c/0x1b0 donewmount+0x298/0x4cc pathmount+0x33c/0x5fc _arm64sysmount+0xcc/0x15c invokesyscall+0x60/0x150 el0svccommon+0xb8/0xf8 doel0svc+0x28/0xa0 el0svc+0x24/0x84 el0t64synchandler+0x88/0xec
It is because inode.icryptinfo is not initialized during below path: - mount - f2fsfillsuper - f2fsdisablecheckpoint - f2fsgc - f2fsiget - f2fs_truncate
So, let's relocate truncation of preallocated blocks to f2fsfileopen(), after fscryptfileopen().