CVE-2023-53447
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53447
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53447.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53447
- Downstream
- Related
- Published
- 2025-09-18T16:04:22Z
- Modified
- 2025-10-16T17:30:51.888732Z
- Summary
- f2fs: don't reset unchangable mount option in f2fs_remount()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
f2fs: don't reset unchangable mount option in f2fs_remount()
syzbot reports a bug as below:
general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:_lockacquire+0x69/0x2000 kernel/locking/lockdep.c:4942 Call Trace: lockacquire+0x1e3/0x520 kernel/locking/lockdep.c:5691 _rawwritelock include/linux/rwlockapismp.h:209 [inline] rawwritelock+0x2e/0x40 kernel/locking/spinlock.c:300 _dropextenttree+0x3ac/0x660 fs/f2fs/extentcache.c:1100 f2fsdropextenttree+0x17/0x30 fs/f2fs/extentcache.c:1116 f2fsinsertrange+0x2d5/0x3c0 fs/f2fs/file.c:1664 f2fsfallocate+0x4e4/0x6d0 fs/f2fs/file.c:1838 vfsfallocate+0x54b/0x6b0 fs/open.c:324 ksysfallocate fs/open.c:347 [inline] _dosysfallocate fs/open.c:355 [inline] _sesysfallocate fs/open.c:353 [inline] _x64sysfallocate+0xbd/0x100 fs/open.c:353 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
The root cause is race condition as below: - since it tries to remount rw filesystem, so that doremount won't call sbprepareremountreadonly to block fallocate, there may be race condition in between remount and fallocate. - in f2fsremount(), defaultoptions() will reset mount option to default one, and then update it based on result of parse_options(), so there is a hole which race condition can happen.
Thread A Thread B - f2fsfillsuper - parseoptions - clearopt(READEXTENTCACHE)
- f2fs_remount
- defaultoptions
- setopt(READEXTENT
- f2fsfallocate
- f2fsinsertrange
- f2fsdropextenttree
- drop
- may
- testopt(READEXTENT
- f2fsdropextenttree
- write
- f2fsinsertrange
- defaultoptions
- parseoptions
- clearopt(READEXTENT
- f2fs_remount
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced98e4da8ca301e062d79ae168c67e56f3c3de3ce4Fixed115557cc226a927924f2d7d1980ccbf6e3b3bb36
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced98e4da8ca301e062d79ae168c67e56f3c3de3ce4Fixed458c15dfbce62c35fefd9ca637b20a051309c9f1