Linux: f2fs: fix to zero post-EOF data when extending file size
What fixes it
- 6882d458d2e403f6ba7b45542dd31a6b7531eb2eLinuxCVE List
- 32c7f11a24268ba8d3bb50ea7f54d33f698cd253LinuxCVE List
- 91ec55ddc097ccddd25ffb95a3d079b2ef362372LinuxCVE List
- 5eced87b7d19dbc76ebdddaf322046f9ac582fcbLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to zero post-EOF data when extending file size
generic/794 4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad) --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800 @@ -1,4 +1,16 @@ QA output created by 794 append_write +FAIL: non-zero data in gap [4080,4096) after shutdown+remount +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a >ZZZZZZZZZZZZZZZZ< +* +001000 truncate_up ... (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad' to see the entire diff) Ran: generic/794 Failures: generic/794 Failed 1 of 1 tests
Steps of generic/794:
- write 4096 bytes to file w/ 0x5a
- use fiemap to get PBA of first block in file
- truncate file to 4080
- umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount
- extend filesize via
a) append 4096 from offset 4096, or b) truncate 8192, or c) fallocate 4096 from offset 4096
- verify the gap is zeroed in memory [4080,4096)
- sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown)
- umount; mount; verify [4080,4096) is zeroed or not.
When extending file size (e.g. via truncate, fallocate, or write) across an unaligned EOF boundary, we need to ensure that post-EOF data in the partial page is zeroed out in pagecache and marked dirty, then writeback the cache to persist zeroed data before committing inode w/ updated i_size.
This help to prevent stale disk data beyond the previous EOF from being exposed after remounting or crash recovery.
Since f2fs is a LFS filesystem, we only support direct write via PBA in pinfile, and pinfile has section-aligned filesize, so in Android, there should no problem, but for other usage in different environment, let's fix this w/ fsync_mode=strict mount option.
Text from CVE List
Affected versions 12
- Linuxaffected: fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a before 6882d458d2e403f6ba7b45542dd31a6b7531eb2eCVE List
- Linuxaffected: fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a before 32c7f11a24268ba8d3bb50ea7f54d33f698cd253CVE List
- Linuxaffected: fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a before 91ec55ddc097ccddd25ffb95a3d079b2ef362372CVE List
- Linuxaffected: fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a before c42608c09b6b5d5967bf211c255914c068c2cde1CVE List
- Linuxaffected: fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a before 5eced87b7d19dbc76ebdddaf322046f9ac582fcbCVE List
- Linuxaffected: 3.8CVE List
- Linuxunaffected: all versions before 3.8CVE List
- Linuxunaffected: 6.6.157 through 6.6.*CVE List
- Linuxunaffected: 6.12.110 through 6.12.*CVE List
- Linuxunaffected: 6.18.51 through 6.18.*CVE List
- Linuxunaffected: 7.2.5 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List
References 5
- git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2eReferencevia CVE List
- git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253Referencevia CVE List
- git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372Referencevia CVE List
- git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1Referencevia CVE List
- git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcbReferencevia CVE List