| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-23132: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| |
| F2FS-fs (dm-59): checkpoint=enable has some unwritten data. |
| |
| ------------[ cut here ]------------ |
| WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308 |
| pc : dquot_writeback_dquots+0x2fc/0x308 |
| lr : f2fs_quota_sync+0xcc/0x1c4 |
| Call trace: |
| dquot_writeback_dquots+0x2fc/0x308 |
| f2fs_quota_sync+0xcc/0x1c4 |
| f2fs_write_checkpoint+0x3d4/0x9b0 |
| f2fs_issue_checkpoint+0x1bc/0x2c0 |
| f2fs_sync_fs+0x54/0x150 |
| f2fs_do_sync_file+0x2f8/0x814 |
| __f2fs_ioctl+0x1960/0x3244 |
| f2fs_ioctl+0x54/0xe0 |
| __arm64_sys_ioctl+0xa8/0xe4 |
| invoke_syscall+0x58/0x114 |
| |
| checkpoint and f2fs_remount may race as below, resulting triggering warning |
| in dquot_writeback_dquots(). |
| |
| atomic write remount |
| - do_remount |
| - down_write(&sb->s_umount); |
| - f2fs_remount |
| - ioctl |
| - f2fs_do_sync_file |
| - f2fs_sync_fs |
| - f2fs_write_checkpoint |
| - block_operations |
| - locked = down_read_trylock(&sbi->sb->s_umount) |
| : fail to lock due to the write lock was held by remount |
| - up_write(&sb->s_umount); |
| - f2fs_quota_sync |
| - dquot_writeback_dquots |
| - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)) |
| : trigger warning because s_umount lock was unlocked by remount |
| |
| If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of |
| checkpoint has already held s_umount lock, calling dquot_writeback_dquots() |
| in the context should be safe. |
| |
| So let's record task to sbi->umount_lock_holder, so that checkpoint can |
| know whether the lock has held in the context or not by checking current |
| w/ it. |
| |
| In addition, in order to not misrepresent caller of checkpoint, we should |
| not allow to trigger async checkpoint for those callers: mount/umount/remount/ |
| freeze/quotactl. |
| |
| The Linux kernel CVE team has assigned CVE-2025-23132 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.20 with commit af033b2aa8a874fd5737fafe90d159136527b5b4 and fixed in 6.14.2 with commit d7acf0a6c87aa282c86a36dbaa2f92fda88c5884 |
| Issue introduced in 4.20 with commit af033b2aa8a874fd5737fafe90d159136527b5b4 and fixed in 6.15 with commit eb85c2410d6f581e957cd03a644ff6ddbe592af9 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-23132 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/f2fs/checkpoint.c |
| fs/f2fs/f2fs.h |
| fs/f2fs/super.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d7acf0a6c87aa282c86a36dbaa2f92fda88c5884 |
| https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9 |
