CVE-2021-47007

What it actually does

Missing bounds check in f2fs_resize_fs allows resize ioctl to a size smaller than required for current valid blocks, causing allocator to hit BUG during block migration in free_segment_range and panic the kernel.

Why it matters to the business

Unprivileged local users on systems using f2fs can trigger kernel panics and system crashes via filesystem resize operations, leading to denial of service and unplanned downtime.

How an attack unfolds

An attacker with write access to an f2fs filesystem creates two large files filling most of the volume, deletes one, then issues an f2fs resize ioctl to a smaller size; the missing space check lets the garbage collector and allocator run out of segments and panic during data migration.

How to fix it

Apply the upstream fix for f2fs_resize_fs that adds the pre-resize space validation; update to a kernel containing the commit that resolves the out-of-space condition before migration.

How to confirm the fix worked

Confirm kernel contains the f2fs resize space check; reproduce the original test case (mkfs, fill, delete, resize) and verify it no longer panics at segment.c:2484.

Typical attack path

1. mount f2fs image
2. write data blocks until nearly full
3. delete portion of data and sync
4. issue F2FS_IOC_RESIZE_FS ioctl requesting smaller size
5. trigger block migration and allocator exhaustion

How to detect it

Search kernel logs for 'kernel BUG at segment.c:2484', f2fs_allocate_data_block failures during resize, or call traces containing f2fs_resize_fs and free_segment_range; correlate with audit logs of F2FS_IOC_RESIZE_FS ioctls.

• kernel BUG at segment.c:2484
• f2fs_resize_fs
• free_segment_range
• allocate_segment_by_default
• F2FS_IOC_RESIZE_FS

What your security team should do

• Patch affected kernels immediately to include the f2fs resize validation fix
• Restrict untrusted users from performing f2fs mount or ioctl operations where possible
• Monitor for f2fs resize attempts in high-privilege contexts