APPLIED: [SRU][J][PATCH 0/1] CVE-2024-53220

[Stefan Bader]

On 09/09/2026 10:00, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2024-53220
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> f2fs: fix to account dirty data in __get_secs_required()
> 
> It will trigger system panic w/ testcase in [1]:
> 
> ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2752! RIP:
> 0010:new_curseg+0xc81/0x2110 Call Trace: f2fs_allocate_data_block+0x1c91/0x4540
> do_write_page+0x163/0xdf0 f2fs_outplace_write_data+0x1aa/0x340
> f2fs_do_write_data_page+0x797/0x2280 f2fs_write_single_data_page+0x16cd/0x2190
> f2fs_write_cache_pages+0x994/0x1c80 f2fs_write_data_pages+0x9cc/0xea0
> do_writepages+0x194/0x7a0 filemap_fdatawrite_wbc+0x12b/0x1a0
> __filemap_fdatawrite_range+0xbb/0xf0 file_write_and_wait_range+0xa1/0x110
> f2fs_do_sync_file+0x26f/0x1c50 f2fs_sync_file+0x12b/0x1d0
> vfs_fsync_range+0xfa/0x230 do_fsync+0x3d/0x80 __x64_sys_fsync+0x37/0x50
> x64_sys_call+0x1e88/0x20d0 do_syscall_64+0x4b/0x110
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> The root cause is if checkpoint_disabling and lfs_mode are both on, it will
> trigger OPU for all overwritten data, it may cost more free segment than
> expected, so f2fs must account those data correctly to calculate cosumed free
> segments later, and return ENOSPC earlier to avoid run out of free segment
> during block allocation.
> 
> [1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/
> 
> [ Fix ]
> 
> jammy/linux: backported from 1acd73edbbfe
> 
> The fix folds the missing dirty-data accounting into the free-segment
> calculation so that overwritten data blocks are counted when checkpoint
> disabling and LFS mode both force out-of-place updates. This lets f2fs return
> ENOSPC before the segment allocator runs out of free segments and hits the
> BUG_ON in new_curseg().
> 
> This tree has no __get_secs_required() helper; the same lower/upper/curseg
> logic lives inline in has_not_enough_free_secs(), so the dirty-data accounting
> was folded there. has_curseg_enough_space() keeps this tree's per-segment
> accounting (f2fs_usable_blks_in_seg - get_seg_entry()->ckpt_valid_blocks)
> instead of upstream's CAP_BLKS_PER_SEC/get_ckpt_valid_blocks while extending
> the loop over CURSEG_HOT_DATA..NR_PERSISTENT_LOG and picking data_blocks vs
> node_blocks.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression would only be visible on systems using the f2fs filesystem, and
> in practice only when it is mounted with LFS mode together with checkpoint
> disabling (typically flash-based storage on mobile and embedded devices). A
> bad fix could miscalculate free-segment reservation and either return ENOSPC
> too early, wasting usable space, or too late, reintroducing the allocator
> panic under heavy fsync/overwrite workloads. Systems not using f2fs, or f2fs
> mounts without both LFS mode and checkpoint disabling, are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-21-g0f091652. Reference: 10e3b253/v1
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/a908fc89/attachment-0001.sig>