CVE-2022-49282— f2fs: quota: fix loop condition at f2fs_quota_sync()
Affected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | a02982545e61020c23f411b073ba5171381138e4< f1d5946d47c0827bae39e1537959ce8d6f0224c5 | affected |
2d586a3f5b7ec2f5a939db4abc9aa053c237545c< e58ee6bd939b773675240f5d0f5b88a367c037c4 | affected | ||
9de71ede81e6d1a111fdd868b2d78d459fa77f80< f9156db0987f1b426015d56505e2c58dee70c90d | affected | ||
9de71ede81e6d1a111fdd868b2d78d459fa77f80< e9ebf1e8fc50b6a9336f9aea1082d7845e568d0e | affected | ||
9de71ede81e6d1a111fdd868b2d78d459fa77f80< 724469814d805820cd37ea789769dba94123ff1a | affected | ||
9de71ede81e6d1a111fdd868b2d78d459fa77f80< 680af5b824a52faa819167628665804a14f0e0df | affected | ||
9dd5052a8a8be252990c1bb451b51f32529411ef | affected | ||
699a077aa087c17cf29c7170db71a34141e2effe | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-49282
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f2fs: quota: fix loop condition at f2fs_quota_sync()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix loop condition at f2fs_quota_sync() cnt should be passed to sb_has_quota_active() instead of type to check active quota properly. Moreover, when the type is -1, the compiler with enough inline knowledge can discard sb_has_quota_active() check altogether, causing a NULL pointer dereference at the following inode_lock(dqopt->files[cnt]): [ 2.796010] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 2.796024] Mem abort info: [ 2.796025] ESR = 0x96000005 [ 2.796028] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.796029] SET = 0, FnV = 0 [ 2.796031] EA = 0, S1PTW = 0 [ 2.796032] Data abort info: [ 2.796034] ISV = 0, ISS = 0x00000005 [ 2.796035] CM = 0, WnR = 0 [ 2.796046] user pgtable: 4k pages, 39-bit VAs, pgdp=00000003370d1000 [ 2.796048] [00000000000000a0] pgd=0000000000000000, pud=0000000000000000 [ 2.796051] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 2.796056] CPU: 7 PID: 640 Comm: f2fs_ckpt-259:7 Tainted: G S 5.4.179-arter97-r8-64666-g2f16e087f9d8 #1 [ 2.796057] Hardware name: Qualcomm Technologies, Inc. Lahaina MTP lemonadep (DT) [ 2.796059] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 2.796065] pc : down_write+0x28/0x70 [ 2.796070] lr : f2fs_quota_sync+0x100/0x294 [ 2.796071] sp : ffffffa3f48ffc30 [ 2.796073] x29: ffffffa3f48ffc30 x28: 0000000000000000 [ 2.796075] x27: ffffffa3f6d718b8 x26: ffffffa415fe9d80 [ 2.796077] x25: ffffffa3f7290048 x24: 0000000000000001 [ 2.796078] x23: 0000000000000000 x22: ffffffa3f7290000 [ 2.796080] x21: ffffffa3f72904a0 x20: ffffffa3f7290110 [ 2.796081] x19: ffffffa3f77a9800 x18: ffffffc020aae038 [ 2.796083] x17: ffffffa40e38e040 x16: ffffffa40e38e6d0 [ 2.796085] x15: ffffffa40e38e6cc x14: ffffffa40e38e6d0 [ 2.796086] x13: 00000000000004f6 x12: 00162c44ff493000 [ 2.796088] x11: 0000000000000400 x10: ffffffa40e38c948 [ 2.796090] x9 : 0000000000000000 x8 : 00000000000000a0 [ 2.796091] x7 : 0000000000000000 x6 : 0000d1060f00002a [ 2.796093] x5 : ffffffa3f48ff718 x4 : 000000000000000d [ 2.796094] x3 : 00000000060c0000 x2 : 0000000000000001 [ 2.796096] x1 : 0000000000000000 x0 : 00000000000000a0 [ 2.796098] Call trace: [ 2.796100] down_write+0x28/0x70 [ 2.796102] f2fs_quota_sync+0x100/0x294 [ 2.796104] block_operations+0x120/0x204 [ 2.796106] f2fs_write_checkpoint+0x11c/0x520 [ 2.796107] __checkpoint_and_complete_reqs+0x7c/0xd34 [ 2.796109] issue_checkpoint_thread+0x6c/0xb8 [ 2.796112] kthread+0x138/0x414 [ 2.796114] ret_from_fork+0x10/0x18 [ 2.796117] Code: aa0803e0 aa1f03e1 52800022 aa0103e9 (c8e97d02) [ 2.796120] ---[ end trace 96e942e8eb6a0b53 ]--- [ 2.800116] Kernel panic - not syncing: Fatal exception [ 2.800120] SMP: stopping secondary CPUs
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于f2fs_quota_sync函数中循环条件错误，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-49282
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-49282
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total
| CVE-2022-49498 | ALSA: pcm: Check for null pointer of pointer substream before dereferencing it | |
| CVE-2022-49486 | ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe | |
| CVE-2022-49488 | drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected | |
| CVE-2022-49489 | drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm run | |
| CVE-2022-49490 | drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected | |
| CVE-2022-49491 | drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() | |
| CVE-2022-49492 | nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags | |
| CVE-2022-49493 | ASoC: rt5645: Fix errorenous cleanup order | |
| CVE-2022-49494 | mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() | |
| CVE-2022-49495 | drm/msm/hdmi: check return value after calling platform_get_resource_byname() | |
| CVE-2022-49497 | net: remove two BUG() from skb_checksum_help() | |
| CVE-2022-49496 | media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko | |
| CVE-2022-49502 | media: rga: fix possible memory leak in rga_probe | |
| CVE-2022-49507 | regulator: da9121: Fix uninit-value in da9121_assign_chip_model() | |
| CVE-2022-49508 | HID: elan: Fix potential double free in elan_input_configured | |
| CVE-2022-49506 | drm/mediatek: Add vblank register/unregister callback functions | |
| CVE-2022-49504 | scsi: lpfc: Inhibit aborts if external loopback plug is inserted | |
| CVE-2022-49505 | NFC: NULL out the dev->rfkill to prevent UAF | |
| CVE-2022-49501 | usbnet: Run unregister_netdev() before unbind() again | |
| CVE-2022-49500 | wl1251: dynamically allocate memory used for DMA |
Showing top 20 of 706 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43492
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_ - CVE-2026-43493
crypto: pcrypt - Fix handling of MAY_BACKLOG requests - CVE-2026-43491
net: qrtr: ns: Limit the maximum server registration per nod - CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length
Same vendor: Linux
- CVE-2026-43492
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_ - CVE-2026-43493
crypto: pcrypt - Fix handling of MAY_BACKLOG requests - CVE-2026-43491
net: qrtr: ns: Limit the maximum server registration per nod - CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length
V. Comments for CVE-2022-49282
No comments yet