From: Chao Yu chao@kernel.org

stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]

As Al reported in link[1]:

f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0);

You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place.

[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/

With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar

[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]

Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara jack@suse.cz Reported-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Chao Yu chao@kernel.org Reviewed-by: Jan Kara jack@suse.cz Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Zizhi Wo wozizhi@huawei.com --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, }

if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else