| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-56565: f2fs: fix to drop all discards after creating snapshot on lvm device |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| f2fs: fix to drop all discards after creating snapshot on lvm device |
| |
| Piergiorgio reported a bug in bugzilla as below: |
| |
| ------------[ cut here ]------------ |
| WARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330 |
| RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs] |
| Call Trace: |
| __issue_discard_cmd+0x1ca/0x350 [f2fs] |
| issue_discard_thread+0x191/0x480 [f2fs] |
| kthread+0xcf/0x100 |
| ret_from_fork+0x31/0x50 |
| ret_from_fork_asm+0x1a/0x30 |
| |
| w/ below testcase, it can reproduce this bug quickly: |
| - pvcreate /dev/vdb |
| - vgcreate myvg1 /dev/vdb |
| - lvcreate -L 1024m -n mylv1 myvg1 |
| - mount /dev/myvg1/mylv1 /mnt/f2fs |
| - dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20 |
| - sync |
| - rm /mnt/f2fs/file |
| - sync |
| - lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1 |
| - umount /mnt/f2fs |
| |
| The root cause is: it will update discard_max_bytes of mounted lvm |
| device to zero after creating snapshot on this lvm device, then, |
| __submit_discard_cmd() will pass parameter @nr_sects w/ zero value |
| to __blkdev_issue_discard(), it returns a NULL bio pointer, result |
| in panic. |
| |
| This patch changes as below for fixing: |
| 1. Let's drop all remained discards in f2fs_unfreeze() if snapshot |
| of lvm device is created. |
| 2. Checking discard_max_bytes before submitting discard during |
| __submit_discard_cmd(). |
| |
| The Linux kernel CVE team has assigned CVE-2024-56565 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.19 with commit 35ec7d5748849762008e8ae9f8ad2766229d5794 and fixed in 6.6.66 with commit ed24ab98242f8d22b66fbe0452c97751b5ea4e22 |
| Issue introduced in 4.19 with commit 35ec7d5748849762008e8ae9f8ad2766229d5794 and fixed in 6.12.4 with commit 15136c3861a3341db261ebdbb6ae4ae1765635e2 |
| Issue introduced in 4.19 with commit 35ec7d5748849762008e8ae9f8ad2766229d5794 and fixed in 6.13 with commit bc8aeb04fd80cb8cfae3058445c84410fd0beb5e |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-56565 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/f2fs/segment.c |
| fs/f2fs/super.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22 |
| https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2 |
| https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e |
