CVE-2024-56692

f2fs: fix to do sanity check on node blkaddr in truncate_node()

State: Published
Severity: 7.8 High
Published: Dec 28, 2024
Updated: Oct 30, 2026
Reserved: Dec 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on node blkaddr in truncate_node()

syzbot reports a f2fs bug as below:

------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534

The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
LinuxLinux	98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before a6d51de6bf729edc9fc7f87ffaae4e6bbda6329aAffected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 27d6e7eff07f8cce8e83b162d8f21a07458c860dAffected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before c1077078ce4589b5e5387f6b0aaa0d4534b9eb57Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 0a5c8b3fbf6200f1c66062d307c9a52084917788Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 6babe00ccd34fc65b78ef8b99754e32b4385f23dAffected
LinuxLinux	3.8Affected before 3.8Not affected 6.1.191 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before a6d51de6bf729edc9fc7f87ffaae4e6bbda6329aAffected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 27d6e7eff07f8cce8e83b162d8f21a07458c860dAffected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before c1077078ce4589b5e5387f6b0aaa0d4534b9eb57Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 0a5c8b3fbf6200f1c66062d307c9a52084917788Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 6babe00ccd34fc65b78ef8b99754e32b4385f23dAffected

LinuxLinux

3.8Affected
before 3.8Not affected
6.1.191 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.