Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: <TASK> f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9 In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided.
Product status
6e9619499f53b22ead972e476c0e8341c997d929 (git) before 9c07bd262c13ca922adad6e7613d48505f97f548
6e9619499f53b22ead972e476c0e8341c997d929 (git) before 72c58a82e6fb7b327e8701f5786c70c3edc56188
6e9619499f53b22ead972e476c0e8341c997d929 (git) before e50b81c50fcbe63f50405bb40f262162ff32af88
6e9619499f53b22ead972e476c0e8341c997d929 (git) before efe3371001f50a2d6f746b50bdc6f9f26b2089ec
6e9619499f53b22ead972e476c0e8341c997d929 (git) before 4f244c64efe628d277b916f47071adf480eb8646
6e9619499f53b22ead972e476c0e8341c997d929 (git) before bac23833220a1f8fe8dfab7e16efa20ff64d7589
6e9619499f53b22ead972e476c0e8341c997d929 (git) before 7c37c79510329cd951a4dedf3f7bf7e2b18dccec
4.7
Any version before 4.7
5.10.248 (semver)
5.15.198 (semver)
6.1.160 (semver)
6.6.120 (semver)
6.12.64 (semver)
6.18.3 (semver)
6.19 (original_commit_for_fix)
References
git.kernel.org/...c/9c07bd262c13ca922adad6e7613d48505f97f548
git.kernel.org/...c/72c58a82e6fb7b327e8701f5786c70c3edc56188
git.kernel.org/...c/e50b81c50fcbe63f50405bb40f262162ff32af88
git.kernel.org/...c/efe3371001f50a2d6f746b50bdc6f9f26b2089ec
git.kernel.org/...c/4f244c64efe628d277b916f47071adf480eb8646
git.kernel.org/...c/bac23833220a1f8fe8dfab7e16efa20ff64d7589
git.kernel.org/...c/7c37c79510329cd951a4dedf3f7bf7e2b18dccec