In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid accessing uninitialized curseg syzbot reports a f2fs bug as below: F2FS-fs (loop3): Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device BUG: unable to handle page fault for address: ffffed1604ea3dfa RIP: 0010:getckptvalidblocks fs/f2fs/segment.h:361 [inline] RIP: 0010:hascursegenoughspace fs/f2fs/segment.h:570 [inline] RIP: 0010:_getsecsrequired fs/f2fs/segment.h:620 [inline] RIP: 0010:hasnotenoughfreesecs fs/f2fs/segment.h:633 [inline] RIP: 0010:hasenoughfreesecs+0x575/0x1660 fs/f2fs/segment.h:649 <TASK> f2fsischeckpointready fs/f2fs/segment.h:671 [inline] f2fswriteinode+0x425/0x540 fs/f2fs/inode.c:791 writeinode fs/fs-writeback.c:1525 [inline] _writebacksingleinode+0x708/0x10d0 fs/fs-writeback.c:1745 writebacksbinodes+0x820/0x1360 fs/fs-writeback.c:1976 wbwriteback+0x413/0xb80 fs/fs-writeback.c:2156 wbdowriteback fs/fs-writeback.c:2303 [inline] wbworkfn+0x410/0x1080 fs/fs-writeback.c:2343 processonework kernel/workqueue.c:3236 [inline] processscheduledworks+0xa66/0x1840 kernel/workqueue.c:3317 workerthread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:148 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 Commit 8b10d3653735 ("f2fs: introduce FAULTNOSEGMENT") allows to trigger no free segment fault in allocator, then it will update curseg->segno to NULLSEGNO, though, CPERRORFLAG has been set, f2fswriteinode() missed to check the flag, and access invalid curseg->segno directly in below call path, then resulting in panic: - f2fswriteinode - f2fsischeckpointready - hasenoughfreesecs - hasnotenoughfreesecs - _getsecsrequired - hascursegenoughspace - getckptvalidblocks : access invalid curseg->segno To avoid this issue, let's: - check CPERRORFLAG flag in prior to f2fsischeckpointready() in f2fswriteinode(). - in hascursegenoughspace(), save curseg->segno into a temp variable, and verify its validation before use.
{ "availability": "No subscription required", "binaries": [ { "binary_version": "7.6.0+6.14.0-22.22", "binary_name": "bpftool" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-buildinfo-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-buildinfo-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-doc" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-lib-rust-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-libc-dev" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-extra-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-ipu6-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-ipu7-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-iwlwifi-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-usbio-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-vision-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-perf" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-source-6.14.0" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-common" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-cloud-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-aws-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-cloud-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-azure-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-azure" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1008.8", "binary_name": "linux-buildinfo-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-buildinfo-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-gcp-headers-6.14.0-1008" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-gcp-tools-6.14.0-1008" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-headers-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-headers-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k-dbgsym" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-dbgsym" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-extra-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-extra-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-tools-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-tools-6.14.0-1008-gcp-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-oracle-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-oracle-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-oracle-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-6.14.0-1007-raspi-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-raspi-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-raspi-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-raspi" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-cloud-tools-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-realtime-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-extra-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-iwlwifi-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-cloud-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-realtime" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-buildinfo-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-headers-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-image-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-image-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-modules-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-riscv-headers-6.14.0-22" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-riscv-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-tools-6.14.0-22-generic" } ] }