CVE-2025-68772

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix to avoid updating compression context during writeback<br /> <br /> Bai, Shuangpeng reported a bug as below:<br /> <br /> Oops: divide error: 0000 [#1] SMP KASAN PTI<br /> CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 #1 PREEMPT(full)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014<br /> RIP: 0010:f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857<br /> Call Trace:<br /> <br /> f2fs_write_cache_pages fs/f2fs/data.c:3078 [inline]<br /> __f2fs_write_data_pages fs/f2fs/data.c:3290 [inline]<br /> f2fs_write_data_pages+0x1c19/0x3600 fs/f2fs/data.c:3317<br /> do_writepages+0x38e/0x640 mm/page-writeback.c:2634<br /> filemap_fdatawrite_wbc mm/filemap.c:386 [inline]<br /> __filemap_fdatawrite_range mm/filemap.c:419 [inline]<br /> file_write_and_wait_range+0x2ba/0x3e0 mm/filemap.c:794<br /> f2fs_do_sync_file+0x6e6/0x1b00 fs/f2fs/file.c:294<br /> generic_write_sync include/linux/fs.h:3043 [inline]<br /> f2fs_file_write_iter+0x76e/0x2700 fs/f2fs/file.c:5259<br /> new_sync_write fs/read_write.c:593 [inline]<br /> vfs_write+0x7e9/0xe00 fs/read_write.c:686<br /> ksys_write+0x19d/0x2d0 fs/read_write.c:738<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xf7/0x470 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> The bug was triggered w/ below race condition:<br /> <br /> fsync setattr ioctl<br /> - f2fs_do_sync_file<br /> - file_write_and_wait_range<br /> - f2fs_write_cache_pages<br /> : inode is non-compressed<br /> : cc.cluster_size =<br /> F2FS_I(inode)-&gt;i_cluster_size = 0<br /> - tag_pages_for_writeback<br /> - f2fs_setattr<br /> - truncate_setsize<br /> - f2fs_truncate<br /> - f2fs_fileattr_set<br /> - f2fs_setflags_common<br /> - set_compress_context<br /> : F2FS_I(inode)-&gt;i_cluster_size = 4<br /> : set_inode_flag(inode, FI_COMPRESSED_FILE)<br /> - f2fs_compressed_file<br /> : return true<br /> - f2fs_all_cluster_page_ready<br /> : "pgidx % cc-&gt;cluster_size" trigger dividing 0 issue<br /> <br /> Let&amp;#39;s change as below to fix this issue:<br /> - introduce a new atomic type variable .writeback in structure f2fs_inode_info<br /> to track the number of threads which calling f2fs_write_cache_pages().<br /> - use .i_sem lock to protect .writeback update.<br /> - check .writeback before update compression context in f2fs_setflags_common()<br /> to avoid race w/ -&gt;writepages.