linux-cve-announce - CVE-2023-53537: f2fs: fix to avoid use-after-free for cached IPU bio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100443-CVE-2023-53537-7d50@gregkh>
Date: Sat,  4 Oct 2025 17:16:51 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53537: f2fs: fix to avoid use-after-free for cached IPU bio

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use-after-free for cached IPU bio

xfstest generic/019 reports a bug:

kernel BUG at mm/filemap.c:1619!
RIP: 0010:folio_end_writeback+0x8a/0x90
Call Trace:
 end_page_writeback+0x1c/0x60
 f2fs_write_end_io+0x199/0x420
 bio_endio+0x104/0x180
 submit_bio_noacct+0xa5/0x510
 submit_bio+0x48/0x80
 f2fs_submit_write_bio+0x35/0x300
 f2fs_submit_merged_ipu_write+0x2a0/0x2b0
 f2fs_write_single_data_page+0x838/0x8b0
 f2fs_write_cache_pages+0x379/0xa30
 f2fs_write_data_pages+0x30c/0x340
 do_writepages+0xd8/0x1b0
 __writeback_single_inode+0x44/0x370
 writeback_sb_inodes+0x233/0x4d0
 __writeback_inodes_wb+0x56/0xf0
 wb_writeback+0x1dd/0x2d0
 wb_workfn+0x367/0x4a0
 process_one_work+0x21d/0x430
 worker_thread+0x4e/0x3c0
 kthread+0x103/0x130
 ret_from_fork+0x2c/0x50

The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
result in submitting random cached bio which belong to other IO context,
then it will cause use-after-free issue, fix it by adding additional
validity check.

The Linux kernel CVE team has assigned CVE-2023-53537 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 5.10.180 with commit b2f423fda64fb49213aa0ed5056079cf295a5df2
	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 5.15.111 with commit 9a7f63283af6befc0f91d549f4f6917dff7479a9
	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 6.1.28 with commit 7d058f0ab161437369ad6e45a4b67c2886e71373
	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 6.2.15 with commit 97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb
	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 6.3.2 with commit af4ce124d7bd74cb839bbdaccffbb416771a56b5
	Issue introduced in 5.5 with commit 0b20fcec8651569935a10afe03fedc0b812d044e and fixed in 6.4 with commit 5cdb422c839134273866208dad5360835ddb9794

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53537
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/data.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b2f423fda64fb49213aa0ed5056079cf295a5df2
	https://git.kernel.org/stable/c/9a7f63283af6befc0f91d549f4f6917dff7479a9
	https://git.kernel.org/stable/c/7d058f0ab161437369ad6e45a4b67c2886e71373
	https://git.kernel.org/stable/c/97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb
	https://git.kernel.org/stable/c/af4ce124d7bd74cb839bbdaccffbb416771a56b5
	https://git.kernel.org/stable/c/5cdb422c839134273866208dad5360835ddb9794