Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path. struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null character of device path string.
Product status
3c62be17d4f562f43fe1d03b48194399caa35aa5 before dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 1cf1ff15f262e8baf12201b270b6a79f9d119b2d
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 666b7cf6ac9aa074b8319a2b68cba7f2c30023f0
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 3466721f06edff834f99d9f49f23eabc6b2cb78e
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 345fc8d1838f3f8be7c8ed08d86a13dedef67136
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 70849d33130a2cf1d6010069ed200669c8651fbd
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 755427093e4294ac111c3f9e40d53f681a0fbdaa
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 1b1efa5f0e878745e94a98022e8edc675a87d78e
3c62be17d4f562f43fe1d03b48194399caa35aa5 before 5661998536af52848cc4d52a377e90368196edea
4.10
Any version before 4.10
5.4.297
5.10.241
5.15.190
6.1.148
6.6.102
6.12.42
6.15.10
6.16.1
6.17
References
git.kernel.org/...c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80
git.kernel.org/...c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d
git.kernel.org/...c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0
git.kernel.org/...c/3466721f06edff834f99d9f49f23eabc6b2cb78e
git.kernel.org/...c/345fc8d1838f3f8be7c8ed08d86a13dedef67136
git.kernel.org/...c/70849d33130a2cf1d6010069ed200669c8651fbd
git.kernel.org/...c/755427093e4294ac111c3f9e40d53f681a0fbdaa
git.kernel.org/...c/1b1efa5f0e878745e94a98022e8edc675a87d78e
git.kernel.org/...c/5661998536af52848cc4d52a377e90368196edea
