CVE-2025-40025

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix to do sanity check on node footer for non inode dnode<br /> <br /> As syzbot reported below:<br /> <br /> ------------[ cut here ]------------<br /> kernel BUG at fs/f2fs/file.c:1243!<br /> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full)<br /> RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243<br /> Call Trace:<br /> <br /> f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306<br /> f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018<br /> vfs_fallocate+0x666/0x7e0 fs/open.c:342<br /> ksys_fallocate fs/open.c:366 [inline]<br /> __do_sys_fallocate fs/open.c:371 [inline]<br /> __se_sys_fallocate fs/open.c:369 [inline]<br /> __x64_sys_fallocate+0xc0/0x110 fs/open.c:369<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> RIP: 0033:0x7f1e65f8ebe9<br /> <br /> w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent<br /> truncation range in direct node in f2fs_truncate_hole().<br /> <br /> The root cause is: a non-inode dnode may has the same footer.ino and<br /> footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE()<br /> may return wrong blkaddr count which may be 923 typically, by chance,<br /> dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below<br /> statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...).<br /> <br /> count = min(end_offset - dn.ofs_in_node, pg_end - pg_start);<br /> <br /> This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing<br /> passing the new_type to sanity_check_node_footer in f2fs_get_node_folio()<br /> to detect corruption that a non-inode dnode has the same footer.ino and<br /> footer.nid.<br /> <br /> Scripts to reproduce:<br /> mkfs.f2fs -f /dev/vdb<br /> mount /dev/vdb /mnt/f2fs<br /> touch /mnt/f2fs/foo<br /> touch /mnt/f2fs/bar<br /> dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8<br /> umount /mnt/f2fs<br /> inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb<br /> mount /dev/vdb /mnt/f2fs<br /> xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k"