| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-22113: ext4: avoid journaling sb update on error if journal is destroying |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: avoid journaling sb update on error if journal is destroying |
| |
| Presently we always BUG_ON if trying to start a transaction on a journal marked |
| with JBD2_UNMOUNT, since this should never happen. However, while ltp running |
| stress tests, it was observed that in case of some error handling paths, it is |
| possible for update_super_work to start a transaction after the journal is |
| destroyed eg: |
| |
| (umount) |
| ext4_kill_sb |
| kill_block_super |
| generic_shutdown_super |
| sync_filesystem /* commits all txns */ |
| evict_inodes |
| /* might start a new txn */ |
| ext4_put_super |
| flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */ |
| jbd2_journal_destroy |
| journal_kill_thread |
| journal->j_flags |= JBD2_UNMOUNT; |
| jbd2_journal_commit_transaction |
| jbd2_journal_get_descriptor_buffer |
| jbd2_journal_bmap |
| ext4_journal_bmap |
| ext4_map_blocks |
| ... |
| ext4_inode_error |
| ext4_handle_error |
| schedule_work(&sbi->s_sb_upd_work) |
| |
| /* work queue kicks in */ |
| update_super_work |
| jbd2_journal_start |
| start_this_handle |
| BUG_ON(journal->j_flags & |
| JBD2_UNMOUNT) |
| |
| Hence, introduce a new mount flag to indicate journal is destroying and only do |
| a journaled (and deferred) update of sb if this flag is not set. Otherwise, just |
| fallback to an un-journaled commit. |
| |
| Further, in the journal destroy path, we have the following sequence: |
| |
| 1. Set mount flag indicating journal is destroying |
| 2. force a commit and wait for it |
| 3. flush pending sb updates |
| |
| This sequence is important as it ensures that, after this point, there is no sb |
| update that might be journaled so it is safe to update the sb outside the |
| journal. (To avoid race discussed in 2d01ddc86606) |
| |
| Also, we don't need a similar check in ext4_grp_locked_error since it is only |
| called from mballoc and AFAICT it would be always valid to schedule work here. |
| |
| The Linux kernel CVE team has assigned CVE-2025-22113 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.11 with commit 2d01ddc86606564fb08c56e3bc93a0693895f710 and fixed in 6.14.2 with commit db05767b5bc307143d99fe2afd8c43af58d2ebef |
| Issue introduced in 5.11 with commit 2d01ddc86606564fb08c56e3bc93a0693895f710 and fixed in 6.15 with commit ce2f26e73783b4a7c46a86e3af5b5c8de0971790 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-22113 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/ext4.h |
| fs/ext4/ext4_jbd2.h |
| fs/ext4/super.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/db05767b5bc307143d99fe2afd8c43af58d2ebef |
| https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790 |
