linux-cve-announce - CVE-2024-53220: f2fs: fix to account dirty data in __get_secs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122733-CVE-2024-53220-3664@gregkh>
Date: Fri, 27 Dec 2024 14:53:06 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-53220: f2fs: fix to account dirty data in __get_secs_required()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to account dirty data in __get_secs_required()

It will trigger system panic w/ testcase in [1]:

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:2752!
RIP: 0010:new_curseg+0xc81/0x2110
Call Trace:
 f2fs_allocate_data_block+0x1c91/0x4540
 do_write_page+0x163/0xdf0
 f2fs_outplace_write_data+0x1aa/0x340
 f2fs_do_write_data_page+0x797/0x2280
 f2fs_write_single_data_page+0x16cd/0x2190
 f2fs_write_cache_pages+0x994/0x1c80
 f2fs_write_data_pages+0x9cc/0xea0
 do_writepages+0x194/0x7a0
 filemap_fdatawrite_wbc+0x12b/0x1a0
 __filemap_fdatawrite_range+0xbb/0xf0
 file_write_and_wait_range+0xa1/0x110
 f2fs_do_sync_file+0x26f/0x1c50
 f2fs_sync_file+0x12b/0x1d0
 vfs_fsync_range+0xfa/0x230
 do_fsync+0x3d/0x80
 __x64_sys_fsync+0x37/0x50
 x64_sys_call+0x1e88/0x20d0
 do_syscall_64+0x4b/0x110
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The root cause is if checkpoint_disabling and lfs_mode are both on,
it will trigger OPU for all overwritten data, it may cost more free
segment than expected, so f2fs must account those data correctly to
calculate cosumed free segments later, and return ENOSPC earlier to
avoid run out of free segment during block allocation.

[1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/

The Linux kernel CVE team has assigned CVE-2024-53220 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.20 with commit 4354994f097d068a894aa1a0860da54571df3582 and fixed in 6.1.120 with commit 6e58b2987960efcd917bc42da781cee256213618
	Issue introduced in 4.20 with commit 4354994f097d068a894aa1a0860da54571df3582 and fixed in 6.6.64 with commit f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5
	Issue introduced in 4.20 with commit 4354994f097d068a894aa1a0860da54571df3582 and fixed in 6.11.11 with commit 9313b85ddc120e2d2f0efaf86d0204d4c98d60b1
	Issue introduced in 4.20 with commit 4354994f097d068a894aa1a0860da54571df3582 and fixed in 6.12.2 with commit e812871c068cc0f91ff9f5cee87d00df1c44aae4
	Issue introduced in 4.20 with commit 4354994f097d068a894aa1a0860da54571df3582 and fixed in 6.13-rc1 with commit 1acd73edbbfef2c3c5b43cba4006a7797eca7050

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-53220
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/segment.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6e58b2987960efcd917bc42da781cee256213618
	https://git.kernel.org/stable/c/f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5
	https://git.kernel.org/stable/c/9313b85ddc120e2d2f0efaf86d0204d4c98d60b1
	https://git.kernel.org/stable/c/e812871c068cc0f91ff9f5cee87d00df1c44aae4
	https://git.kernel.org/stable/c/1acd73edbbfef2c3c5b43cba4006a7797eca7050