CVE-2025-22127

When running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I encountered a problem in generic/475 test where fsstress process gets blocked in _f2fswritedatapages() and the test hangs. The options I used are:

MKFSOPTIONS -- -O compression -O extraattr -O projectquota -O quota /dev/vdc MOUNTOPTIONS -- -o acl,userxattr -o discard,compressextension=* /dev/vdc /vdc

INFO: task kworker/u8:0:11 blocked for more than 122 seconds. Not tainted 6.14.0-rc3-xfstests-lockdep #1 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:kworker/u8:0 state:D stack:0 pid:11 tgid:11 ppid:2 taskflags:0x4208160 flags:0x00004000 Workqueue: writeback wbworkfn (flush-253:0) Call Trace: <TASK> _schedule+0x309/0x8e0 schedule+0x3a/0x100 schedulepreemptdisabled+0x15/0x30 _mutexlock+0x59a/0xdb0 _f2fswritedatapages+0x3ac/0x400 dowritepages+0xe8/0x290 _writebacksingleinode+0x5c/0x360 writebacksbinodes+0x22f/0x570 wbwriteback+0xb0/0x410 wbdowriteback+0x47/0x2f0 wbworkfn+0x5a/0x1c0 processonework+0x223/0x5b0 workerthread+0x1d5/0x3c0 kthread+0xfd/0x230 retfromfork+0x31/0x50 retfromforkasm+0x1a/0x30 </TASK>

The root cause is: once generic/475 starts toload error table to dm device, f2fspreparecompress_overwrite() will loop reading compressed cluster pages due to IO error, meanwhile it has held .writepages lock, it can block all other writeback tasks.

Let's fix this issue w/ below changes: - add f2fshandlepageeio() in preparecompressoverwrite() to detect IO error. - detect cperror earler in f2fsreadmulti_pages().

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

4c8ff7095bef64fc47e996a938f7d57f9e077da3

Fixed

7215cf8ef54bdc9082dffac4662416d54961e258

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

4c8ff7095bef64fc47e996a938f7d57f9e077da3

Fixed

3147ee567dd9004a49826ddeaf0a4b12865d4409

Affected versions

v5.*

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.5

v5.5-rc2

v5.5-rc3

v5.5-rc4

v5.5-rc5

v5.5-rc6

v5.5-rc7

v5.6

v5.6-rc1

v5.6-rc2

v5.6-rc3

v5.6-rc4

v5.6-rc5

v5.6-rc6

v5.6-rc7

v5.7

v5.7-rc1

v5.7-rc2

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.14.1

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3147ee567dd9004a49826ddeaf0a4b12865d4409",
        "digest": {
            "function_hash": "97317583362511457047812772367070945842",
            "length": 3312.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/data.c",
            "function": "f2fs_read_multi_pages"
        },
        "id": "CVE-2025-22127-011e42b9",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7215cf8ef54bdc9082dffac4662416d54961e258",
        "digest": {
            "function_hash": "210072821659598619832863666654460878250",
            "length": 1655.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/compress.c",
            "function": "prepare_compress_overwrite"
        },
        "id": "CVE-2025-22127-1bb12a63",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7215cf8ef54bdc9082dffac4662416d54961e258",
        "digest": {
            "line_hashes": [
                "65536260179218319198532367600038162918",
                "174481961564395526918185556559610423125",
                "256005010742619738394727883077922875654",
                "205330410729292686021633243947271195274"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/compress.c"
        },
        "id": "CVE-2025-22127-28ea36eb",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3147ee567dd9004a49826ddeaf0a4b12865d4409",
        "digest": {
            "function_hash": "210072821659598619832863666654460878250",
            "length": 1655.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/compress.c",
            "function": "prepare_compress_overwrite"
        },
        "id": "CVE-2025-22127-4ce8c567",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3147ee567dd9004a49826ddeaf0a4b12865d4409",
        "digest": {
            "line_hashes": [
                "65536260179218319198532367600038162918",
                "174481961564395526918185556559610423125",
                "256005010742619738394727883077922875654",
                "205330410729292686021633243947271195274"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/compress.c"
        },
        "id": "CVE-2025-22127-5130abb7",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7215cf8ef54bdc9082dffac4662416d54961e258",
        "digest": {
            "function_hash": "97317583362511457047812772367070945842",
            "length": 3312.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/data.c",
            "function": "f2fs_read_multi_pages"
        },
        "id": "CVE-2025-22127-7637fd13",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3147ee567dd9004a49826ddeaf0a4b12865d4409",
        "digest": {
            "line_hashes": [
                "312789573912672734746319990194076237902",
                "142586329831572547450335241020454182005",
                "56602819442846905587656215093767363133",
                "300600884981685355135650859948390325158",
                "28128705644417286725946971518833909763",
                "151718627205445470644187419235630765036",
                "135195752965066442856722273949641577182",
                "126516929137618747025647075404069922343",
                "186284333954980030001196712816611607050",
                "61187558835373792125875513380602490212"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/data.c"
        },
        "id": "CVE-2025-22127-c55dfeaf",
        "deprecated": false
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7215cf8ef54bdc9082dffac4662416d54961e258",
        "digest": {
            "line_hashes": [
                "312789573912672734746319990194076237902",
                "142586329831572547450335241020454182005",
                "56602819442846905587656215093767363133",
                "300600884981685355135650859948390325158",
                "28128705644417286725946971518833909763",
                "151718627205445470644187419235630765036",
                "135195752965066442856722273949641577182",
                "126516929137618747025647075404069922343",
                "186284333954980030001196712816611607050",
                "61187558835373792125875513380602490212"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "target": {
            "file": "fs/f2fs/data.c"
        },
        "id": "CVE-2025-22127-df18fe3c",
        "deprecated": false
    }
]

CVE-2025-22127

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Affected versions

v5.*

v6.*

Database specific

vanir_signatures

Linux / Kernel

Package

Affected ranges