CVE-2025-22127 (GCVE-0-2025-22127)
Vulnerability from cvelistv5
Published
2025-04-16 14:13
Modified
2025-05-26 05:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix potential deadloop in prepare_compress_overwrite()
Jan Prusakowski reported a kernel hang issue as below:
When running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I
encountered a problem in generic/475 test where fsstress process
gets blocked in __f2fs_write_data_pages() and the test hangs.
The options I used are:
MKFS_OPTIONS -- -O compression -O extra_attr -O project_quota -O quota /dev/vdc
MOUNT_OPTIONS -- -o acl,user_xattr -o discard,compress_extension=* /dev/vdc /vdc
INFO: task kworker/u8:0:11 blocked for more than 122 seconds.
Not tainted 6.14.0-rc3-xfstests-lockdep #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:0 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00004000
Workqueue: writeback wb_workfn (flush-253:0)
Call Trace:
<TASK>
__schedule+0x309/0x8e0
schedule+0x3a/0x100
schedule_preempt_disabled+0x15/0x30
__mutex_lock+0x59a/0xdb0
__f2fs_write_data_pages+0x3ac/0x400
do_writepages+0xe8/0x290
__writeback_single_inode+0x5c/0x360
writeback_sb_inodes+0x22f/0x570
wb_writeback+0xb0/0x410
wb_do_writeback+0x47/0x2f0
wb_workfn+0x5a/0x1c0
process_one_work+0x223/0x5b0
worker_thread+0x1d5/0x3c0
kthread+0xfd/0x230
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>
The root cause is: once generic/475 starts toload error table to dm
device, f2fs_prepare_compress_overwrite() will loop reading compressed
cluster pages due to IO error, meanwhile it has held .writepages lock,
it can block all other writeback tasks.
Let's fix this issue w/ below changes:
- add f2fs_handle_page_eio() in prepare_compress_overwrite() to
detect IO error.
- detect cp_error earler in f2fs_read_multi_pages().
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c",
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7215cf8ef54bdc9082dffac4662416d54961e258",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
},
{
"lessThan": "3147ee567dd9004a49826ddeaf0a4b12865d4409",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c",
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.2",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix potential deadloop in prepare_compress_overwrite()\n\nJan Prusakowski reported a kernel hang issue as below:\n\nWhen running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I\nencountered a problem in generic/475 test where fsstress process\ngets blocked in __f2fs_write_data_pages() and the test hangs.\nThe options I used are:\n\nMKFS_OPTIONS -- -O compression -O extra_attr -O project_quota -O quota /dev/vdc\nMOUNT_OPTIONS -- -o acl,user_xattr -o discard,compress_extension=* /dev/vdc /vdc\n\nINFO: task kworker/u8:0:11 blocked for more than 122 seconds.\n Not tainted 6.14.0-rc3-xfstests-lockdep #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u8:0 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00004000\nWorkqueue: writeback wb_workfn (flush-253:0)\nCall Trace:\n \u003cTASK\u003e\n __schedule+0x309/0x8e0\n schedule+0x3a/0x100\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock+0x59a/0xdb0\n __f2fs_write_data_pages+0x3ac/0x400\n do_writepages+0xe8/0x290\n __writeback_single_inode+0x5c/0x360\n writeback_sb_inodes+0x22f/0x570\n wb_writeback+0xb0/0x410\n wb_do_writeback+0x47/0x2f0\n wb_workfn+0x5a/0x1c0\n process_one_work+0x223/0x5b0\n worker_thread+0x1d5/0x3c0\n kthread+0xfd/0x230\n ret_from_fork+0x31/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThe root cause is: once generic/475 starts toload error table to dm\ndevice, f2fs_prepare_compress_overwrite() will loop reading compressed\ncluster pages due to IO error, meanwhile it has held .writepages lock,\nit can block all other writeback tasks.\n\nLet\u0027s fix this issue w/ below changes:\n- add f2fs_handle_page_eio() in prepare_compress_overwrite() to\ndetect IO error.\n- detect cp_error earler in f2fs_read_multi_pages()."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-26T05:19:03.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7215cf8ef54bdc9082dffac4662416d54961e258"
},
{
"url": "https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"
}
],
"title": "f2fs: fix potential deadloop in prepare_compress_overwrite()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-22127",
"datePublished": "2025-04-16T14:13:10.015Z",
"dateReserved": "2024-12-29T08:45:45.824Z",
"dateUpdated": "2025-05-26T05:19:03.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-22127\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:06.813\",\"lastModified\":\"2025-04-17T20:22:16.240\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix potential deadloop in prepare_compress_overwrite()\\n\\nJan Prusakowski reported a kernel hang issue as below:\\n\\nWhen running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I\\nencountered a problem in generic/475 test where fsstress process\\ngets blocked in __f2fs_write_data_pages() and the test hangs.\\nThe options I used are:\\n\\nMKFS_OPTIONS -- -O compression -O extra_attr -O project_quota -O quota /dev/vdc\\nMOUNT_OPTIONS -- -o acl,user_xattr -o discard,compress_extension=* /dev/vdc /vdc\\n\\nINFO: task kworker/u8:0:11 blocked for more than 122 seconds.\\n Not tainted 6.14.0-rc3-xfstests-lockdep #1\\n\\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\ntask:kworker/u8:0 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00004000\\nWorkqueue: writeback wb_workfn (flush-253:0)\\nCall Trace:\\n \u003cTASK\u003e\\n __schedule+0x309/0x8e0\\n schedule+0x3a/0x100\\n schedule_preempt_disabled+0x15/0x30\\n __mutex_lock+0x59a/0xdb0\\n __f2fs_write_data_pages+0x3ac/0x400\\n do_writepages+0xe8/0x290\\n __writeback_single_inode+0x5c/0x360\\n writeback_sb_inodes+0x22f/0x570\\n wb_writeback+0xb0/0x410\\n wb_do_writeback+0x47/0x2f0\\n wb_workfn+0x5a/0x1c0\\n process_one_work+0x223/0x5b0\\n worker_thread+0x1d5/0x3c0\\n kthread+0xfd/0x230\\n ret_from_fork+0x31/0x50\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nThe root cause is: once generic/475 starts toload error table to dm\\ndevice, f2fs_prepare_compress_overwrite() will loop reading compressed\\ncluster pages due to IO error, meanwhile it has held .writepages lock,\\nit can block all other writeback tasks.\\n\\nLet\u0027s fix this issue w/ below changes:\\n- add f2fs_handle_page_eio() in prepare_compress_overwrite() to\\ndetect IO error.\\n- detect cp_error earler in f2fs_read_multi_pages().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrige un posible bucle muerto en prepare_compress_overwrite() Jan Prusakowski inform\u00f3 un problema de bloqueo del kernel como se muestra a continuaci\u00f3n: Al ejecutar xfstests en el kernel linux-next (6.14.0-rc3, 6.12), encontr\u00e9 un problema en la prueba generic/475 donde el proceso fsstress se bloquea en __f2fs_write_data_pages() y la prueba se bloquea. Las opciones que utilic\u00e9 son: MKFS_OPTIONS -- -O compression -O extra_attr -O project_quota -O quota /dev/vdc MOUNT_OPTIONS -- -o acl,user_xattr -o discard,compress_extension=* /dev/vdc /vdc INFO: la tarea kworker/u8:0:11 se bloque\u00f3 durante m\u00e1s de 122 segundos. No contaminado 6.14.0-rc3-xfstests-lockdep #1 \\\"echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\\\" deshabilita este mensaje. tarea:kworker/u8:0 estado:D pila:0 pid:11 tgid:11 ppid:2 indicadores_de_tarea:0x4208160 indicadores:0x00004000 Cola de trabajo: reescritura wb_workfn (flush-253:0) Rastreo de llamadas: __schedule+0x309/0x8e0 schedule+0x3a/0x100 schedule_preempt_disabled+0x15/0x30 __mutex_lock+0x59a/0xdb0 __f2fs_write_data_pages+0x3ac/0x400 do_writepages+0xe8/0x290 __writeback_single_inode+0x5c/0x360 writeback_sb_inodes+0x22f/0x570 La causa ra\u00edz es: una vez que generic/475 comienza a cargar la tabla de errores en el dispositivo dm, f2fs_prepare_compress_overwrite() leer\u00e1 en bucle las p\u00e1ginas comprimidas del cl\u00faster debido a un error de E/S, mientras mantiene el bloqueo .writepages, puede bloquear todas las dem\u00e1s tareas de escritura diferida. Solucionemos este problema con los siguientes cambios: - agregue f2fs_handle_page_eio() en prepare_compress_overwrite() para detectar errores de E/S. - detecte cp_error antes en f2fs_read_multi_pages().\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7215cf8ef54bdc9082dffac4662416d54961e258\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…