Executive brief
F2FS is a flash-friendly filesystem used in Linux kernels to optimize performance on solid-state storage. During system shutdown or filesystem unmount, if a checkpoint error occurs, the kernel can crash with a fatal BUG assertion, causing the unmount operation to fail and potentially leaving the system in an inconsistent state. This results in system instability and forced shutdown.
Technical details
The vulnerability is a denial-of-service condition in the F2FS filesystem driver that occurs during umount() when a checkpoint error (cp_error) is set. The root cause is in the f2fs_wait_on_all_pages() function in fs/f2fs/checkpoint.c, which prematurely stops waiting for dirty pages to be written back when cp_error is detected, leaving fsync_node_num in a non-zero state. This triggers a BUG_ON() assertion in f2fs_put_super() at line 1627, causing a kernel panic. The fix checks the SBI_IS_CLOSE flag during unmount to force the completion of page writeback and drops dirty pages rather than redirtying them, preventing the deadlock condition. The vulnerability is local to the system and requires no special privileges or network access, affecting any Linux system with F2FS mounted.
Affected products
- Linux Linux kernel multiple versions affected (fix applied across stable branches)
Timeline
- 2023-04-10: other: Patch authored by Chao Yu
- 2023-05-24: patched: Fix included in stable kernel releases
- 2023-05-30: patched: Fix included in additional stable kernel releases