CVE-2025-38163

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count<br /> <br /> syzbot reported a f2fs bug as below:<br /> <br /> ------------[ cut here ]------------<br /> kernel BUG at fs/f2fs/f2fs.h:2521!<br /> RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521<br /> Call Trace:<br /> f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695<br /> truncate_dnode+0x417/0x740 fs/f2fs/node.c:973<br /> truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014<br /> f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197<br /> f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810<br /> f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838<br /> f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888<br /> f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112<br /> notify_change+0xbca/0xe90 fs/attr.c:552<br /> do_truncate+0x222/0x310 fs/open.c:65<br /> handle_truncate fs/namei.c:3466 [inline]<br /> do_open fs/namei.c:3849 [inline]<br /> path_openat+0x2e4f/0x35d0 fs/namei.c:4004<br /> do_filp_open+0x284/0x4e0 fs/namei.c:4031<br /> do_sys_openat2+0x12b/0x1d0 fs/open.c:1429<br /> do_sys_open fs/open.c:1444 [inline]<br /> __do_sys_creat fs/open.c:1522 [inline]<br /> __se_sys_creat fs/open.c:1516 [inline]<br /> __x64_sys_creat+0x124/0x170 fs/open.c:1516<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94<br /> <br /> The reason is: in fuzzed image, sbi-&gt;total_valid_block_count is<br /> inconsistent w/ mapped blocks indexed by inode, so, we should<br /> not trigger panic for such case, instead, let&amp;#39;s print log and<br /> set fsck flag.