In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to account dirty data in _getsecs_required()
It will trigger system panic w/ testcase in [1]:
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2752! RIP: 0010:newcurseg+0xc81/0x2110 Call Trace: f2fsallocatedatablock+0x1c91/0x4540 dowritepage+0x163/0xdf0 f2fsoutplacewritedata+0x1aa/0x340 f2fsdowritedatapage+0x797/0x2280 f2fswritesingledatapage+0x16cd/0x2190 f2fswritecachepages+0x994/0x1c80 f2fswritedatapages+0x9cc/0xea0 dowritepages+0x194/0x7a0 filemapfdatawritewbc+0x12b/0x1a0 _filemapfdatawriterange+0xbb/0xf0 filewriteandwaitrange+0xa1/0x110 f2fsdosyncfile+0x26f/0x1c50 f2fssyncfile+0x12b/0x1d0 vfsfsyncrange+0xfa/0x230 dofsync+0x3d/0x80 _x64sysfsync+0x37/0x50 x64syscall+0x1e88/0x20d0 dosyscall64+0x4b/0x110 entrySYSCALL64afterhwframe+0x76/0x7e
The root cause is if checkpointdisabling and lfsmode are both on, it will trigger OPU for all overwritten data, it may cost more free segment than expected, so f2fs must account those data correctly to calculate cosumed free segments later, and return ENOSPC earlier to avoid run out of free segment during block allocation.
[1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/
[ { "signature_type": "Line", "id": "CVE-2024-53220-0ad4807a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e812871c068cc0f91ff9f5cee87d00df1c44aae4", "signature_version": "v1", "target": { "file": "fs/f2fs/segment.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "133033369930099358791497831176416330519", "99520368105683585154538736844063026606", "48681144542615688812562849268681037698", "16944446252722421133437627621863466243", "150583174942509402692786934682675220738", "332327678914847220511617023836152553160", "100343810935344985275900373217517727213", "76835350007694141851005605115460094648", "166536975531798990284464773169356758416", "318612308654552319032863303323080066777", "239887202031426839227595643923112558086", "308705714449553251495112400407607966302", "274339770892241139656669375905183345160", "196827006521647730607129215207913900537", "98426563121108968155290448725546075633", "282770902472779363982961055698328341977", "275170429375939587474784053516029095631", "115749912705639083878118043728853624938", "7781096918022730766019060508168034662", "136455607021151700458503338438393917209", "277020650735496745687924392338258241825", "92958976106537213712014559130686301139", "15818027673609604935758176596757591526", "82287813179102603347185782230611776389", "323870094537829269526923783181859126089", "144957411824298498397950598437535997778", "299749431666481441975656132356766683178", "217954530099015206779447304120444918894", "5048397293588528163893690232108856111", "322007502031137417819262602665507390003", "46341901626926515414015702956325667705" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53220-314ab49f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e58b2987960efcd917bc42da781cee256213618", "signature_version": "v1", "target": { "file": "fs/f2fs/segment.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "133033369930099358791497831176416330519", "99520368105683585154538736844063026606", "48681144542615688812562849268681037698", "16944446252722421133437627621863466243", "150583174942509402692786934682675220738", "332327678914847220511617023836152553160", "100343810935344985275900373217517727213", "76835350007694141851005605115460094648", "166536975531798990284464773169356758416", "318612308654552319032863303323080066777", "239887202031426839227595643923112558086", "308705714449553251495112400407607966302", "274339770892241139656669375905183345160", "196827006521647730607129215207913900537", "98426563121108968155290448725546075633", "282770902472779363982961055698328341977", "275170429375939587474784053516029095631", "115749912705639083878118043728853624938", "7781096918022730766019060508168034662", "136455607021151700458503338438393917209", "277020650735496745687924392338258241825", "92958976106537213712014559130686301139", "15818027673609604935758176596757591526", "82287813179102603347185782230611776389", "323870094537829269526923783181859126089", "144957411824298498397950598437535997778", "299749431666481441975656132356766683178", "217954530099015206779447304120444918894", "5048397293588528163893690232108856111", "322007502031137417819262602665507390003", "46341901626926515414015702956325667705" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53220-397e5f9b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1acd73edbbfef2c3c5b43cba4006a7797eca7050", "signature_version": "v1", "target": { "file": "fs/f2fs/segment.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "133033369930099358791497831176416330519", "99520368105683585154538736844063026606", "48681144542615688812562849268681037698", "16944446252722421133437627621863466243", "150583174942509402692786934682675220738", "332327678914847220511617023836152553160", "100343810935344985275900373217517727213", "76835350007694141851005605115460094648", "166536975531798990284464773169356758416", "318612308654552319032863303323080066777", "239887202031426839227595643923112558086", "308705714449553251495112400407607966302", "274339770892241139656669375905183345160", "196827006521647730607129215207913900537", "98426563121108968155290448725546075633", "282770902472779363982961055698328341977", "275170429375939587474784053516029095631", "115749912705639083878118043728853624938", "7781096918022730766019060508168034662", "136455607021151700458503338438393917209", "277020650735496745687924392338258241825", "92958976106537213712014559130686301139", "15818027673609604935758176596757591526", "82287813179102603347185782230611776389", "323870094537829269526923783181859126089", "144957411824298498397950598437535997778", "299749431666481441975656132356766683178", "217954530099015206779447304120444918894", "5048397293588528163893690232108856111", "322007502031137417819262602665507390003", "46341901626926515414015702956325667705" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-4fe7c91e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e812871c068cc0f91ff9f5cee87d00df1c44aae4", "signature_version": "v1", "target": { "function": "__get_secs_required", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "157894696425816899710646924332992414413", "length": 672.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-51db847b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e58b2987960efcd917bc42da781cee256213618", "signature_version": "v1", "target": { "function": "has_curseg_enough_space", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "132657289196982707312398320857051872533", "length": 500.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-673a0dae", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1acd73edbbfef2c3c5b43cba4006a7797eca7050", "signature_version": "v1", "target": { "function": "__get_secs_required", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "157894696425816899710646924332992414413", "length": 672.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53220-846548b2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9313b85ddc120e2d2f0efaf86d0204d4c98d60b1", "signature_version": "v1", "target": { "file": "fs/f2fs/segment.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "133033369930099358791497831176416330519", "99520368105683585154538736844063026606", "48681144542615688812562849268681037698", "16944446252722421133437627621863466243", "150583174942509402692786934682675220738", "332327678914847220511617023836152553160", "100343810935344985275900373217517727213", "76835350007694141851005605115460094648", "166536975531798990284464773169356758416", "318612308654552319032863303323080066777", "239887202031426839227595643923112558086", "308705714449553251495112400407607966302", "274339770892241139656669375905183345160", "196827006521647730607129215207913900537", "98426563121108968155290448725546075633", "282770902472779363982961055698328341977", "275170429375939587474784053516029095631", "115749912705639083878118043728853624938", "7781096918022730766019060508168034662", "136455607021151700458503338438393917209", "277020650735496745687924392338258241825", "92958976106537213712014559130686301139", "15818027673609604935758176596757591526", "82287813179102603347185782230611776389", "323870094537829269526923783181859126089", "144957411824298498397950598437535997778", "299749431666481441975656132356766683178", "217954530099015206779447304120444918894", "5048397293588528163893690232108856111", "322007502031137417819262602665507390003", "46341901626926515414015702956325667705" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-86bad2a8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5", "signature_version": "v1", "target": { "function": "__get_secs_required", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "157894696425816899710646924332992414413", "length": 672.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-8c44b251", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1acd73edbbfef2c3c5b43cba4006a7797eca7050", "signature_version": "v1", "target": { "function": "has_curseg_enough_space", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "132657289196982707312398320857051872533", "length": 500.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-a1c0f23a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9313b85ddc120e2d2f0efaf86d0204d4c98d60b1", "signature_version": "v1", "target": { "function": "__get_secs_required", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "157894696425816899710646924332992414413", "length": 672.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-bc17dc91", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9313b85ddc120e2d2f0efaf86d0204d4c98d60b1", "signature_version": "v1", "target": { "function": "has_curseg_enough_space", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "132657289196982707312398320857051872533", "length": 500.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-c25f0cbd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e812871c068cc0f91ff9f5cee87d00df1c44aae4", "signature_version": "v1", "target": { "function": "has_curseg_enough_space", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "132657289196982707312398320857051872533", "length": 500.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-cd1c9534", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5", "signature_version": "v1", "target": { "function": "has_curseg_enough_space", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "132657289196982707312398320857051872533", "length": 500.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53220-de0d8178", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5", "signature_version": "v1", "target": { "file": "fs/f2fs/segment.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "133033369930099358791497831176416330519", "99520368105683585154538736844063026606", "48681144542615688812562849268681037698", "16944446252722421133437627621863466243", "150583174942509402692786934682675220738", "332327678914847220511617023836152553160", "100343810935344985275900373217517727213", "76835350007694141851005605115460094648", "166536975531798990284464773169356758416", "318612308654552319032863303323080066777", "239887202031426839227595643923112558086", "308705714449553251495112400407607966302", "274339770892241139656669375905183345160", "196827006521647730607129215207913900537", "98426563121108968155290448725546075633", "282770902472779363982961055698328341977", "275170429375939587474784053516029095631", "115749912705639083878118043728853624938", "7781096918022730766019060508168034662", "136455607021151700458503338438393917209", "277020650735496745687924392338258241825", "92958976106537213712014559130686301139", "15818027673609604935758176596757591526", "82287813179102603347185782230611776389", "323870094537829269526923783181859126089", "144957411824298498397950598437535997778", "299749431666481441975656132356766683178", "217954530099015206779447304120444918894", "5048397293588528163893690232108856111", "322007502031137417819262602665507390003", "46341901626926515414015702956325667705" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53220-f486bda4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e58b2987960efcd917bc42da781cee256213618", "signature_version": "v1", "target": { "function": "__get_secs_required", "file": "fs/f2fs/segment.h" }, "digest": { "function_hash": "157894696425816899710646924332992414413", "length": 672.0 }, "deprecated": false } ]