In the Linux kernel, the following vulnerability has been resolved:
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
– ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) – shrink
– f2fs_gc
– gc_data_segment
– ra_data_block(cow_inode)
– mapping = F2FS_I(inode)->atomic_inode->i_mapping
: f2fs_is_cow_file(cow_inode) is true
– f2fs_evict_inode(atomic_inode)
– clear_inode_flag(fi->cow_inode, FI_COW_FILE)
– F2FS_I(fi->cow_inode)->atomic_inode = NULL
…
– truncate_inode_pages_final(atomic_inode)
– f2fs_grab_cache_folio(mapping)
: create folio in atomic_inode->mapping
– clear_inode(atomic_inode)
– BUG_ON(atomic_inode->i_data.nrpages)
We need to add a reference on fi->atomic_inode before using its mapping
field during garbage collection, otherwise, it will cause UAF issue.
