In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to drop all dirty pages during umount() if cp_error is set
xfstest generic/361 reports a bug as below:
f2fsbugon(sbi, sbi->fsyncnodenum);
kernel BUG at fs/f2fs/super.c:1627! RIP: 0010:f2fsputsuper+0x3a8/0x3b0 Call Trace: genericshutdownsuper+0x8c/0x1b0 killblocksuper+0x2b/0x60 killf2fssuper+0x87/0x110 deactivatelockedsuper+0x39/0x80 deactivatesuper+0x46/0x50 cleanupmnt+0x109/0x170 _cleanupmnt+0x16/0x20 taskworkrun+0x65/0xa0 exittousermodeprepare+0x175/0x190 syscallexittousermode+0x25/0x50 dosyscall64+0x4c/0x90 entrySYSCALL64afterhwframe+0x72/0xdc
During umount(), if cperror is set, f2fswaitonallpages() should not stop waiting all F2FSWBCPDATA pages to be writebacked, otherwise, fsyncnodenum can be non-zero after f2fswaitonallpages() causing this bug.
In this case, to avoid deadloop in f2fswaitonallpages(), it needs to drop all dirty pages rather than redirtying them.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54124.json",
"cna_assigner": "Linux"
}