CVE-2022-48877

What it actually does

Missing validation of extent_tree existence in f2fs during data page writeback allows a null dereference leading to kernel panic in __lookup_extent_tree.

Why it matters to the business

Unexpected system crashes on Linux devices using f2fs can interrupt operations, cause data corruption during writeback, and require reboots, increasing downtime in affected environments.

How an attack unfolds

An attacker or workload triggers f2fs writeback paths (such as dirty page flushing) on a file system instance where the extent_tree was never allocated, causing the lookup routine to dereference a null pointer and panic the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit dd83a9763e29ed7a21c8a43f7a62cd0a6bf74692. For Android, apply the 2021-05-01 security patches to platform/system/bt in versions 10 and 11.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later; reproduce writeback workloads on f2fs and verify absence of the described panic trace.

Typical attack path

1. Mount or access an f2fs file system
2. Perform or induce write operations that dirty pages
3. Trigger writeback via sync, memory pressure, or background flusher
4. Reach f2fs_do_write_data_page without a prior extent_tree allocation
5. Invoke __lookup_extent_tree on the uninitialized tree causing panic

How to detect it

Search kernel logs and crash dumps for the call trace containing __lookup_extent_tree followed by f2fs_do_write_data_page, f2fs_write_single_data_page, and writeback functions; correlate with f2fs mount points.

• __lookup_extent_tree+0xd8/0x760
• f2fs_do_write_data_page+0x104/0x87c
• f2fs_write_single_data_page+0x420/0xb60
• f2fs_write_cache_pages+0x418/0xb1c

What your security team should do

• Prioritize kernel updates on all systems using f2fs
• Monitor for f2fs-related kernel panics in logs
• Test patched kernels in staging before broad deployment
• Review f2fs usage in production workloads for exposure