kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/fs/f2fs
History
Chao Yu 01118321e0 f2fs: fix UAF issue in f2fs_merge_page_bio() 
[ Upstream commit edf7e9040f ]

As JY reported in bugzilla [1],

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98
lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4
CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P    B   W  OE      6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5
Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Workqueue: writeback wb_workfn (flush-254:49)
Call trace:
 f2fs_is_cp_guaranteed+0x70/0x98
 f2fs_inplace_write_data+0x174/0x2f4
 f2fs_do_write_data_page+0x214/0x81c
 f2fs_write_single_data_page+0x28c/0x764
 f2fs_write_data_pages+0x78c/0xce4
 do_writepages+0xe8/0x2fc
 __writeback_single_inode+0x4c/0x4b4
 writeback_sb_inodes+0x314/0x540
 __writeback_inodes_wb+0xa4/0xf4
 wb_writeback+0x160/0x448
 wb_workfn+0x2f0/0x5dc
 process_scheduled_works+0x1c8/0x458
 worker_thread+0x334/0x3f0
 kthread+0x118/0x1ac
 ret_from_fork+0x10/0x20

[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575

The panic was caused by UAF issue w/ below race condition:

kworker
- writepages
 - f2fs_write_cache_pages
  - f2fs_write_single_data_page
   - f2fs_do_write_data_page
    - f2fs_inplace_write_data
     - f2fs_merge_page_bio
      - add_inu_page
      : cache page #1 into bio & cache bio in
        io->bio_list
  - f2fs_write_single_data_page
   - f2fs_do_write_data_page
    - f2fs_inplace_write_data
     - f2fs_merge_page_bio
      - add_inu_page
      : cache page #2 into bio which is linked
        in io->bio_list
						write
						- f2fs_write_begin
						: write page #1
						 - f2fs_folio_wait_writeback
						  - f2fs_submit_merged_ipu_write
						   - f2fs_submit_write_bio
						   : submit bio which inclues page #1 and #2

						software IRQ
						- f2fs_write_end_io
						 - fscrypt_free_bounce_page
						 : freed bounced page which belongs to page #2
      - inc_page_count( , WB_DATA_TYPE(data_folio), false)
      : data_folio points to fio->encrypted_page
        the bounced page can be freed before
        accessing it in f2fs_is_cp_guarantee()

It can reproduce w/ below testcase:
Run below script in shell #1:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"

Run below script in shell #2:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"

So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after
commit page into internal ipu cache.

Fixes: 0b20fcec86 ("f2fs: cache global IPU bio")
Reported-by: JY <JY.Ho@mediatek.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-10-15 12:04:11 +02:00
..
acl.c f2fs: Pass a folio to f2fs_getxattr() 2025-04-28 15:26:42 +00:00
acl.h f2fs: Pass folios to f2fs_init_acl() 2025-04-28 15:26:41 +00:00
checkpoint.c f2fs: Add folio counterparts to page_private_flags functions 2025-07-22 15:57:05 +00:00
compress.c f2fs: fix to zero data after EOF for compressed file correctly 2025-10-15 12:03:41 +02:00
data.c f2fs: fix UAF issue in f2fs_merge_page_bio() 2025-10-15 12:04:11 +02:00
debug.c f2fs: introduce is_cur{seg,sec}() 2025-07-09 18:02:20 +00:00
dir.c f2fs: Remove clear_page_private_all() 2025-07-22 15:58:00 +00:00
extent_cache.c f2fs: Pass a folio to ofs_of_node() 2025-07-22 15:56:53 +00:00
f2fs.h f2fs: fix condition in __allow_reserved_blocks() 2025-10-15 12:03:41 +02:00
file.c f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() 2025-10-15 12:03:59 +02:00
gc.c f2fs: fix to avoid migrating empty section 2025-10-15 12:03:59 +02:00
gc.h f2fs: add gc_boost_gc_greedy sysfs node 2025-07-29 15:02:36 +00:00
hash.c f2fs: don't use casefolded comparison for "." and ".." 2022-05-17 11:19:23 -07:00
inline.c f2fs: Add folio counterparts to page_private_flags functions 2025-07-22 15:57:05 +00:00
inode.c f2fs: drop inode from the donation list when the last file is closed 2025-07-30 17:13:12 +00:00
iostat.c f2fs: add async reset zone command support 2023-06-12 13:04:09 -07:00
iostat.h f2fs: use iostat_lat_type directly as a parameter in the iostat_update_and_unbind_ctx() 2023-02-07 10:39:28 -08:00
Kconfig f2fs: switch to using the crc32 library 2024-12-01 17:23:02 -08:00
Makefile f2fs: separate out iostat feature 2021-08-23 10:25:51 -07:00
namei.c f2fs: Use a folio in f2fs_encrypted_get_link() 2025-07-22 15:57:54 +00:00
node.c f2fs: fix to do sanity check on node footer for non inode dnode 2025-10-12 13:01:57 +02:00
node.h f2fs: fix to do sanity check on node footer for non inode dnode 2025-10-12 13:01:57 +02:00
recovery.c f2fs: fix to do sanity check on node footer for non inode dnode 2025-10-12 13:01:57 +02:00
segment.c f2fs: Pass a folio to f2fs_submit_merged_write_cond() 2025-07-22 15:58:05 +00:00
segment.h f2fs: fix to calculate dirty data during has_not_enough_free_secs() 2025-07-28 16:36:42 +00:00
shrinker.c f2fs: handle error cases of memory donation 2025-05-06 15:46:55 +00:00
super.c f2fs: fix to allow removing qf_name 2025-10-15 12:03:45 +02:00
sysfs.c f2fs: add gc_boost_gc_greedy sysfs node 2025-07-29 15:02:36 +00:00
verity.c f2fs-6.12-rc1 2024-09-24 15:12:38 -07:00
xattr.c f2fs: Pass a folio to inline_xattr_addr() 2025-04-28 15:26:43 +00:00
xattr.h f2fs: Pass a folio to f2fs_getxattr() 2025-04-28 15:26:42 +00:00