{"id":"CVE-2024-56565","state":"PUBLISHED","title":"f2fs: fix to drop all discards after creating snapshot on lvm device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to drop all discards after creating snapshot on lvm device\n\nPiergiorgio reported a bug in bugzilla as below:\n\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330\nRIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs]\nCall Trace:\n __issue_discard_cmd+0x1ca/0x350 [f2fs]\n issue_discard_thread+0x191/0x480 [f2fs]\n kthread+0xcf/0x100\n ret_from_fork+0x31/0x50\n ret_from_fork_asm+0x1a/0x30\n\nw/ below testcase, it can reproduce this bug quickly:\n- pvcreate /dev/vdb\n- vgcreate myvg1 /dev/vdb\n- lvcreate -L 1024m -n mylv1 myvg1\n- mount /dev/myvg1/mylv1 /mnt/f2fs\n- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20\n- sync\n- rm /mnt/f2fs/file\n- sync\n- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1\n- umount /mnt/f2fs\n\nThe root cause is: it will update discard_max_bytes of mounted lvm\ndevice to zero after creating snapshot on this lvm device, then,\n__submit_discard_cmd() will pass parameter @nr_sects w/ zero value\nto __blkdev_issue_discard(), it returns a NULL bio pointer, result\nin panic.\n\nThis patch changes as below for fixing:\n1. Let's drop all remained discards in f2fs_unfreeze() if snapshot\nof lvm device is created.\n2. Checking discard_max_bytes before submitting discard during\n__submit_discard_cmd().","publishedAt":"2024-12-27T14:23:09.350Z","updatedAt":"2026-10-30T12:20:18.174Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"0f3b00763dae90e94eed94a39d32d252d8750e9d","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"ed24ab98242f8d22b66fbe0452c97751b5ea4e22","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"15136c3861a3341db261ebdbb6ae4ae1765635e2","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"bc8aeb04fd80cb8cfae3058445c84410fd0beb5e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/segment.c","fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/segment.c","fs/f2fs/super.c"]}],"references":["https://git.kernel.org/stable/c/0f3b00763dae90e94eed94a39d32d252d8750e9d","https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22","https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2","https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e"],"weaknesses":[],"ingestedAt":"2026-10-30T12:36:04.432Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56565.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56565","state":"PUBLISHED","datePublished":"2024-12-27T14:23:09.350Z","dateUpdated":"2026-10-30T12:20:18.174Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:05.995Z"},"containers":{"cna":{"title":"f2fs: fix to drop all discards after creating snapshot on lvm device","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to drop all discards after creating snapshot on lvm device\n\nPiergiorgio reported a bug in bugzilla as below:\n\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330\nRIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs]\nCall Trace:\n __issue_discard_cmd+0x1ca/0x350 [f2fs]\n issue_discard_thread+0x191/0x480 [f2fs]\n kthread+0xcf/0x100\n ret_from_fork+0x31/0x50\n ret_from_fork_asm+0x1a/0x30\n\nw/ below testcase, it can reproduce this bug quickly:\n- pvcreate /dev/vdb\n- vgcreate myvg1 /dev/vdb\n- lvcreate -L 1024m -n mylv1 myvg1\n- mount /dev/myvg1/mylv1 /mnt/f2fs\n- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20\n- sync\n- rm /mnt/f2fs/file\n- sync\n- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1\n- umount /mnt/f2fs\n\nThe root cause is: it will update discard_max_bytes of mounted lvm\ndevice to zero after creating snapshot on this lvm device, then,\n__submit_discard_cmd() will pass parameter @nr_sects w/ zero value\nto __blkdev_issue_discard(), it returns a NULL bio pointer, result\nin panic.\n\nThis patch changes as below for fixing:\n1. Let's drop all remained discards in f2fs_unfreeze() if snapshot\nof lvm device is created.\n2. Checking discard_max_bytes before submitting discard during\n__submit_discard_cmd()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"0f3b00763dae90e94eed94a39d32d252d8750e9d","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"ed24ab98242f8d22b66fbe0452c97751b5ea4e22","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"15136c3861a3341db261ebdbb6ae4ae1765635e2","versionType":"git"},{"version":"35ec7d5748849762008e8ae9f8ad2766229d5794","status":"affected","lessThan":"bc8aeb04fd80cb8cfae3058445c84410fd0beb5e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/segment.c","fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/segment.c","fs/f2fs/super.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/0f3b00763dae90e94eed94a39d32d252d8750e9d"},{"url":"https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22"},{"url":"https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2"},{"url":"https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:20:18.174Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.6.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.12.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}