CVE-2024-56586: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix f2fsbugon when uninstalling filesystem call f2fsevictinode.
creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fsbugon as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fsevictinode+0x58c/0x610 Call Trace: diebody+0x15/0x60 die+0x33/0x50 dotrap+0x10a/0x120 f2fsevictinode+0x58c/0x610 doerrortrap+0x60/0x80 f2fsevictinode+0x58c/0x610 excinvalidop+0x53/0x60 f2fsevictinode+0x58c/0x610 asmexcinvalidop+0x16/0x20 f2fsevictinode+0x58c/0x610 evict+0x101/0x260 disposelist+0x30/0x50 evictinodes+0x140/0x190 genericshutdownsuper+0x2f/0x150 killblocksuper+0x11/0x40 killf2fssuper+0x7d/0x140 deactivatelockedsuper+0x2a/0x70 cleanupmnt+0xb3/0x140 taskworkrun+0x61/0x90
The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fsenablecheckpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fsevictinode function, which triggers BUGON. The steps to reproduce are as follows:
dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fsdir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fsdir umount f2fsdir
Let's redirty inode when there is not free segments during checkpoint is disable.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56586?
CVE-2024-56586 is classified as a medium severity vulnerability in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-56586?
CVE-2024-56586 affects various versions of the Linux kernel including 5.10.223-1 and earlier, up to 5.10.234-1, and 6.1 series versions prior to 6.1.129-1.
How do I fix CVE-2024-56586?
To fix CVE-2024-56586, upgrade to patched versions of the Linux kernel such as 5.10.234-1, 6.1.129-1, or newer.
What exploit scenarios are associated with CVE-2024-56586?
CVE-2024-56586 could potentially be exploited by creating large files during checkpoint disable until space runs out.
Is there any workaround for CVE-2024-56586 until I can patch?
Currently, it is recommended to avoid creating large files during checkpoint disable as a temporary measure against CVE-2024-56586.