High · published February 22, 2024
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid dirent corruption
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.2.0, < 4.19.306 | 4.19.306 |
| linux/linux_kernel | ≥ 4.20, < 5.4.268 | 5.4.268 |
| linux/linux_kernel | ≥ 5.5.0, < 5.10.209 | 5.10.209 |
| linux/linux_kernel | ≥ 5.11.0, < 5.15.148 | 5.15.148 |
| linux/linux_kernel | ≥ 5.16.0, < 6.1.75 | 6.1.75 |
| linux/linux_kernel | ≥ 6.2.0, < 6.6.14 | 6.6.14 |
| linux/linux_kernel | ≥ 6.7.0, < 6.7.2 | 6.7.2 |