Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < 02160112e6d45c2610b049df6eb693d7a2e57b46affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < 5624a3c1b1ebc8991318e1cce2aa719542991024affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < 6f866885e147d33efc497f1095f35b2ee5ec7310affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < f100ba617d8be6c98a68f3744ef7617082975b77affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < f0145860c20be6bae6785c7a2249577674702ac7affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < d3c0b49aaa12a61d560528f5d605029ab57f0728affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < 2fb4867f4405aea8c0519d7d188207f232a57862affected7e01e7ad746bc8198a8b46163ddc73a1c7d22339 to < 53edb549565f55ccd0bdf43be3d66ce4c2d48b28affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected4.19.306 to ≤ 4.19.*unaffected5.4.268 to ≤ 5.4.*unaffected5.10.209 to ≤ 5.10.*unaffected5.15.148 to ≤ 5.15.*unaffected6.1.75 to ≤ 6.1.*unaffected6.6.14 to ≤ 6.6.*unaffected6.7.2 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46 ↗
- https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 ↗
- https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310 ↗
- https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77 ↗
- https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7 ↗
- https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728 ↗
- https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862 ↗
- https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗