Chao Yu

The issue is related to the f2fs file system in the Linux kernel. It can trigger a system panic when `checkpoint disabling` and `lfs mode` are both enabled, causing incorrect accounting of dirty data in ` get secs required()`. This may lead to an out-of-free-segment condition during block allocation. The root cause is the failure to account for overwritten data correctly, resulting in excessive free segment usage.

The issue is related to the f2fs compression feature in the Linux kernel. If a data block in a compressed cluster is not persisted with metadata during a checkpoint, after a Storage Power Off Recovery (SPOR), the data may be corrupted. The fix guarantees that compressed pages are written by the checkpoint.

The issue is related to a use-after-free vulnerability in the f2fs read multi pages() function. When f2fs decompress cluster() is called and a cached page is hit in compress inode's cache, the `dic` may be released. To avoid accessing an invalid `dic` pointer, the loop needs to be broken rather than continued. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is caused by a race condition between truncate and overwrite operations in the f2fs compress functionality. This can lead to a situation where a page is detached from the mapping tree after truncation, and later, `find lock page()` may return a NULL pointer. The root cause is that `truncate()` may race with overwrite, so that one reference count left in the page cannot guarantee the page is attached to the mapping tree all the time. Technical details about exploitation include: - The `prepare compress overwrite` function - The `f2fs pagecache get page` function - The `unlock page` function - The `f2fs setattr` function - The `truncate setsize` function - The `truncate inode page` function - The `delete from page cache` function - The `find lock page` function

The issue is related to a panic that occurs during the `f2fs resize fs()` function in the Linux kernel. This happens when the filesystem is resized to a smaller size, and there is not enough space to store all valid blocks. The root cause is the failure to check for sufficient space in the resized filesystem before migrating blocks, leading to an out-of-space condition during block migration in `free segment range()`. The vulnerable function is `f2fs resize fs()`, and the affected code path includes `allocate segment by default()`, `f2fs allocate data block()`, `do write page()`, `f2fs outplace write data()`, `f2fs do write data page()`, `move data page()`, `do garbage collect()`, and `free segment range()`.

The issue is related to a missing bounds check in the `f2fs xattr generic list` function of `xattr.c`, which could lead to a possible out of bounds read. This may result in local information disclosure, requiring System execution privileges for exploitation. No user interaction is needed for exploitation.