Linux Kernel F2FS Filesystem LRU List Corruption Vulnerability

A race condition vulnerability has been identified in the Linux kernel's F2FS (Flash-Friendly File System) implementation, specifically in versions prior to the latest patch. This vulnerability can lead to kernel panics, particularly when the F2FS partition is nearly full. The issue arises because an F2FS page can be freed to the buddy allocator without being removed from the Least Recently Used (LRU) list, causing a corruption of the LRU links. The root cause is a race introduced by a previous commit, which altered how garbage collection handles folios (a type of memory management unit) in the page cache. This change allows the garbage collector to evict folios from the cache, but if the eviction process races with other operations that manage the folio's reference counts, it can result in the folio being freed while still linked in the LRU, leading to a detected list corruption.

Impact

Exploitation of this vulnerability causes a kernel panic due to list corruption, where the LRU list's integrity is compromised, and the kernel reports a corruption error. This panic can disrupt system operations and availability.

Reproduction

The vulnerability can be reproduced by filling an F2FS partition close to its capacity, which triggers the garbage collection process. This process can inadvertently create a race condition between folio management and LRU list updates, leading to the corruption issue.

Remediation

Users can apply the latest patch available in the Linux kernel stable tree to address this vulnerability.