From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C49A192B7F for ; Sat, 11 Jan 2025 12:25:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736598329; cv=none; b=lITgxDV6PyH+o9NGUAsjPZb/IqCyIjfXL1MuODakYiW7AIQoQJ1vm9XwK1ILFxii6MvYLJKMUlCHoqgvdm4Z4wO7qPOizmqNgrDL/ezPz7HZBmR90zFQbL/uELXCXipsbS0RQRKuvI2JngG2vxGguV7yc/hVoEBDlLIZ/MWVoaA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736598329; c=relaxed/simple; bh=+nyApulzCel1bmvS8hLpOrs0eFniRnga5pillh2X+aw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=q2Ny1dL/VwYmdegqEtrf/g+5nQLcqtYBjbQPGAo90pCp/9q8bH1nJFU+K8/g9fTH7H/P2I1N4kpYcPwgoHglcGafdhb8DUKXbqI6VSxHkp0QZQtRqABe2O7ePFOx4ruBOgKGlLgjcV4hjHC6mroKXXfD5wngtbxnveq9TH23038= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kCLWoKAV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="kCLWoKAV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1685DC4CED2; Sat, 11 Jan 2025 12:25:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1736598328; bh=+nyApulzCel1bmvS8hLpOrs0eFniRnga5pillh2X+aw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=kCLWoKAVexJN5ep6z1hUZJP6E/qyLPTy/TrqHhwHJzBAOgz4KDzDDlUryfHfLoIrG BxP4gAqpV8Ssrswh3W/5iJbRZX/wAR612/O1tnjwZ83Kt31LReuV70e28h0c3IzSq9 4WMvu/2iyOfOi9PZeEwsGHnEQSbUN7/XQFxh/KpU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-41935: f2fs: fix to shrink read extent node in batches Date: Sat, 11 Jan 2025 13:25:17 +0100 Message-ID: <2025011118-CVE-2024-41935-e11d@gregkh> X-Mailer: git-send-email 2.48.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2146; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=+nyApulzCel1bmvS8hLpOrs0eFniRnga5pillh2X+aw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOlNyXpz+IRjZyuaHVv9PC1s7/FFm1Krj2z2K0ur0sv34 /SUb3vZEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABPZkciwYGlezNZlohomV2Yc CJZ4/je7KmNfM8OCWcelAtcLzztofeWPehmf9vF7jjN+AAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to shrink read extent node in batches We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue. This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold. The Linux kernel CVE team has assigned CVE-2024-41935 to this issue. Affected and fixed versions =========================== Fixed in 6.6.66 with commit 295b50e95e900da31ff237e46e04525fa799b2cf Fixed in 6.12.5 with commit 924f7dd1e832e4e4530d14711db223d2803f7b61 Fixed in 6.13-rc1 with commit 3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-41935 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/f2fs/extent_cache.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/295b50e95e900da31ff237e46e04525fa799b2cf https://git.kernel.org/stable/c/924f7dd1e832e4e4530d14711db223d2803f7b61 https://git.kernel.org/stable/c/3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343