f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

[Jiucheng Xu]

Dear 5.15.y maintainers,

A f2fs patch should be backported from upstream mainline to the stable 
5.15.y branch. The patch's information is shown as below:

[Subject]
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

[Upstream commit ID]
7c30d79930132466f5be7d0b57add14d1a016bda

[Kernel version]
5.15.y

[Why]
This patch fixes the issue where the f2fs_inode_info.gdirty_list is not 
deleted when evicting the inode. This would cause the gdirty_list to 
remain incorrectly linked when the f2fs_inode_info is reallocated, which 
in turn would be detected by __list_del_entry_valid during list_del_init.

On the Android 5.15 U arm platform, the issue that could be reproduced 
within 24 hours has not recurred for a week after applying this patch.

Thanks,
Jiucheng

Re: f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

[Greg KH]

On Mon, Aug 18, 2025 at 09:46:32AM +0000, Jiucheng Xu wrote:
> Dear 5.15.y maintainers,
> 
> A f2fs patch should be backported from upstream mainline to the stable 
> 5.15.y branch. The patch's information is shown as below:
> 
> [Subject]
> f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
> 
> [Upstream commit ID]
> 7c30d79930132466f5be7d0b57add14d1a016bda
> 
> [Kernel version]
> 5.15.y
> 
> [Why]
> This patch fixes the issue where the f2fs_inode_info.gdirty_list is not 
> deleted when evicting the inode. This would cause the gdirty_list to 
> remain incorrectly linked when the f2fs_inode_info is reallocated, which 
> in turn would be detected by __list_del_entry_valid during list_del_init.
> 
> On the Android 5.15 U arm platform, the issue that could be reproduced 
> within 24 hours has not recurred for a week after applying this patch.

It's already queued up for the next 5.15.y release, thanks!

greg k-h