linux-cve-announce - CVE-2024-53218: f2fs: fix race in concurrent f2fs_stop_gc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122732-CVE-2024-53218-4330@gregkh>
Date: Fri, 27 Dec 2024 14:53:04 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-53218: f2fs: fix race in concurrent f2fs_stop_gc_thread

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix race in concurrent f2fs_stop_gc_thread

In my test case, concurrent calls to f2fs shutdown report the following
stack trace:

 Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI
 CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85
 Call Trace:
  <TASK>
  ? show_regs+0x8b/0xa0
  ? __die_body+0x26/0xa0
  ? die_addr+0x54/0x90
  ? exc_general_protection+0x24b/0x5c0
  ? asm_exc_general_protection+0x26/0x30
  ? kthread_stop+0x46/0x390
  f2fs_stop_gc_thread+0x6c/0x110
  f2fs_do_shutdown+0x309/0x3a0
  f2fs_ioc_shutdown+0x150/0x1c0
  __f2fs_ioctl+0xffd/0x2ac0
  f2fs_ioctl+0x76/0xe0
  vfs_ioctl+0x23/0x60
  __x64_sys_ioctl+0xce/0xf0
  x64_sys_call+0x2b1b/0x4540
  do_syscall_64+0xa7/0x240
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

The root cause is a race condition in f2fs_stop_gc_thread() called from
different f2fs shutdown paths:

  [CPU0]                       [CPU1]
  ----------------------       -----------------------
  f2fs_stop_gc_thread          f2fs_stop_gc_thread
                                 gc_th = sbi->gc_thread
    gc_th = sbi->gc_thread
    kfree(gc_th)
    sbi->gc_thread = NULL
                                 < gc_th != NULL >
                                 kthread_stop(gc_th->f2fs_gc_task) //UAF

The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in
f2fs_stop_gc_thread()") attempted to fix this issue by using a read
semaphore to prevent races between shutdown and remount threads, but
it fails to prevent all race conditions.

Fix it by converting to write lock of s_umount in f2fs_do_shutdown().

The Linux kernel CVE team has assigned CVE-2024-53218 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.16 with commit 7950e9ac638e84518fbdd5c930939ad46a1068c5 and fixed in 6.6.64 with commit 794fa8792d4eacac191f1cbcc2e81b7369e4662a
	Issue introduced in 4.16 with commit 7950e9ac638e84518fbdd5c930939ad46a1068c5 and fixed in 6.11.11 with commit 60457ed6c67625c87861f96912b4179dc2293896
	Issue introduced in 4.16 with commit 7950e9ac638e84518fbdd5c930939ad46a1068c5 and fixed in 6.12.2 with commit c631207897a9b3d41167ceca58e07f8f94720e42
	Issue introduced in 4.16 with commit 7950e9ac638e84518fbdd5c930939ad46a1068c5 and fixed in 6.13-rc1 with commit 7b0033dbc48340a1c1c3f12448ba17d6587ca092

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-53218
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/file.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a
	https://git.kernel.org/stable/c/60457ed6c67625c87861f96912b4179dc2293896
	https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42
	https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092