CVE-2024-47691: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid use-after-free in f2fsstopgcthread()
syzbot reports a f2fs bug as below:
dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 printreport+0xe8/0x550 mm/kasan/report.c:491 kasanreport+0x143/0x180 mm/kasan/report.c:601 kasancheckrange+0x282/0x290 mm/kasan/generic.c:189 instrumentatomicreadwrite include/linux/instrumented.h:96 [inline] atomicfetchaddrelaxed include/linux/atomic/atomic-instrumented.h:252 [inline] refcountadd include/linux/refcount.h:184 [inline] refcountinc include/linux/refcount.h:241 [inline] refcountinc include/linux/refcount.h:258 [inline] gettaskstruct include/linux/sched/task.h:118 [inline] kthreadstop+0xca/0x630 kernel/kthread.c:704 f2fsstopgcthread+0x65/0xb0 fs/f2fs/gc.c:210 f2fsdoshutdown+0x192/0x540 fs/f2fs/file.c:2283 f2fsiocshutdown fs/f2fs/file.c:2325 [inline] f2fsioctl+0x443a/0xbe60 fs/f2fs/file.c:4325 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl+0xfc/0x170 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
The root cause is below race condition, it may cause use-after-free issue in sbi->gcth pointer.
- remount - f2fsremount - f2fsstopgcthread - kfree(gcth) - f2fsiocshutdown - f2fsdoshutdown - f2fsstopgcthread - kthreadstop(gcth->f2fsgctask) : sbi->gcthread = NULL;
We will call f2fsdoshutdown() in two paths: - for f2fsiocshutdown() path, we should grab sb->sumount semaphore for fixing. - for f2fsshutdown() path, it's safe since caller has already grabbed sb->sumount semaphore.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47691?
The severity of CVE-2024-47691 is rated as high due to its impact on the Linux kernel's stability.
How do I fix CVE-2024-47691?
To fix CVE-2024-47691, you should update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions are affected by CVE-2024-47691?
CVE-2024-47691 affects Linux kernel versions between 4.16 and 6.6.54, as well as versions from 6.7 to 6.10.13 and 6.11 to 6.11.2.
Is CVE-2024-47691 a use-after-free vulnerability?
Yes, CVE-2024-47691 is identified as a use-after-free vulnerability in f2fs related to f2fs_stop_gc_thread().
What components are impacted by CVE-2024-47691?
CVE-2024-47691 impacts the f2fs (Flash-Friendly File System) component of the Linux kernel.