In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: fix folio_nr_pages() race after put in large folio invalidate<\/p>\n
Our v6.18 based Android system is continuely suffering livelock and bad
\npage stat as shown in[1] which related to broken xarray slot status. By
\ninvestigating big folio operations within f2fs, we find below races and
\nfix it by get the nr_pages before drop the refcount and folio_lock.<\/p>\n
f2fs_get_read_data_folio() calls f2fs_folio_put() before
\nfolio_nr_pages() when invalidating a large folio from the page cache.
\nThat unlocks the folio and drops the caller reference, leaving a window
\nwhere a concurrent truncate or folio split can shrink the compound folio
\nor free it before the invalidate range is computed. An undersized range
\nthen leaves split sub-folios in mapping->i_pages, which can later
\ninteract badly with truncate and reclaim (stale xarray entries and bad
\npage state when folio->mapping no longer matches the mapping being
\ntruncated).<\/p>\n
[1]
\nPID: 2594 TASK: ffffff8169b81580 CPU: 7 COMMAND: “Thread-3”
\n #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4
\n #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798
\n #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c
\n #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c
\n #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400
\n #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4
\n #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4
\n #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204
\n #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc
\n #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c
\n #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c
\n #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034
\n #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200
\n #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c
\n #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54
\n #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: fix folio_nr_pages() race after put in large folio invalidate<\/p>\n
Our v6.18 based Android system is continuely suffering liveloc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24523","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}