CVE-2023-54151

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: Fix system crash due to lack of free space in LFS<br /> <br /> When f2fs tries to checkpoint during foreground gc in LFS mode, system<br /> crash occurs due to lack of free space if the amount of dirty node and<br /> dentry pages generated by data migration exceeds free space.<br /> The reproduction sequence is as follows.<br /> <br /> - 20GiB capacity block device (null_blk)<br /> - format and mount with LFS mode<br /> - create a file and write 20,000MiB<br /> - 4k random write on full range of the file<br /> <br /> RIP: 0010:new_curseg+0x48a/0x510 [f2fs]<br /> Code: 55 e7 f5 89 c0 48 0f af c3 48 8b 5d c0 48 c1 e8 20 83 c0 01 89 43 6c 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0b f0 41 80 4f 48 04 45 85 f6 0f 84 ba fd ff ff e9 ef fe ff ff<br /> RSP: 0018:ffff977bc397b218 EFLAGS: 00010246<br /> RAX: 00000000000027b9 RBX: 0000000000000000 RCX: 00000000000027c0<br /> RDX: 0000000000000000 RSI: 00000000000027b9 RDI: ffff8c25ab4e74f8<br /> RBP: ffff977bc397b268 R08: 00000000000027b9 R09: ffff8c29e4a34b40<br /> R10: 0000000000000001 R11: ffff977bc397b0d8 R12: 0000000000000000<br /> R13: ffff8c25b4dd81a0 R14: 0000000000000000 R15: ffff8c2f667f9000<br /> FS: 0000000000000000(0000) GS:ffff8c344ec80000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 000000c00055d000 CR3: 0000000e30810003 CR4: 00000000003706e0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> allocate_segment_by_default+0x9c/0x110 [f2fs]<br /> f2fs_allocate_data_block+0x243/0xa30 [f2fs]<br /> ? __mod_lruvec_page_state+0xa0/0x150<br /> do_write_page+0x80/0x160 [f2fs]<br /> f2fs_do_write_node_page+0x32/0x50 [f2fs]<br /> __write_node_page+0x339/0x730 [f2fs]<br /> f2fs_sync_node_pages+0x5a6/0x780 [f2fs]<br /> block_operations+0x257/0x340 [f2fs]<br /> f2fs_write_checkpoint+0x102/0x1050 [f2fs]<br /> f2fs_gc+0x27c/0x630 [f2fs]<br /> ? folio_mark_dirty+0x36/0x70<br /> f2fs_balance_fs+0x16f/0x180 [f2fs]<br /> <br /> This patch adds checking whether free sections are enough before checkpoint<br /> during gc.<br /> <br /> [Jaegeuk Kim: code clean-up]