Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < 7ffac0deea2d84cf79051f16fed8e215c4bcf0e6affectedd0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < d358d2fc6be11eefde5eb1286f1c43a6d0330db6affectedd0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < 3b85edf3391f3e1f624f409a7d2d239885f567b7affectedd0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < b8ae1228c153622afa71a179c9d4dc268117e0f0affectedd0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < b9776094aa7118e8e5dfdcd791ffc8330c5ca408affectedd0b9e42ab6155dc05fc83f00af9f45d4dd02264d to < 8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7ffac0deea2d84cf79051f16fed8e215c4bcf0e6 ↗
- https://git.kernel.org/stable/c/d358d2fc6be11eefde5eb1286f1c43a6d0330db6 ↗
- https://git.kernel.org/stable/c/3b85edf3391f3e1f624f409a7d2d239885f567b7 ↗
- https://git.kernel.org/stable/c/b8ae1228c153622afa71a179c9d4dc268117e0f0 ↗
- https://git.kernel.org/stable/c/b9776094aa7118e8e5dfdcd791ffc8330c5ca408 ↗
- https://git.kernel.org/stable/c/8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1 ↗