CVE-2025-23132

In the Linux kernel, the following vulnerability has been resolved:

f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

F2FS-fs (dm-59): checkpoint=enable has some unwritten data.

------------[ cut here ]------------

WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308

pc : dquot_writeback_dquots+0x2fc/0x308

lr : f2fs_quota_sync+0xcc/0x1c4

Call trace:

dquot_writeback_dquots+0x2fc/0x308

f2fs_quota_sync+0xcc/0x1c4

f2fs_write_checkpoint+0x3d4/0x9b0

f2fs_issue_checkpoint+0x1bc/0x2c0

f2fs_sync_fs+0x54/0x150

f2fs_do_sync_file+0x2f8/0x814

__f2fs_ioctl+0x1960/0x3244

f2fs_ioctl+0x54/0xe0

__arm64_sys_ioctl+0xa8/0xe4

invoke_syscall+0x58/0x114

checkpoint and f2fs_remount may race as below, resulting triggering warning

in dquot_writeback_dquots().

atomic write remount

- do_remount

- down_write(&sb->s_umount);

- f2fs_remount

- ioctl

- f2fs_do_sync_file

- f2fs_sync_fs

- f2fs_write_checkpoint

- block_operations

- locked = down_read_trylock(&sbi->sb->s_umount)

: fail to lock due to the write lock was held by remount

- up_write(&sb->s_umount);

- f2fs_quota_sync

- dquot_writeback_dquots

- WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount))

: trigger warning because s_umount lock was unlocked by remount

If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of

checkpoint has already held s_umount lock, calling dquot_writeback_dquots()

in the context should be safe.

So let's record task to sbi->umount_lock_holder, so that checkpoint can

know whether the lock has held in the context or not by checking current

w/ it.

In addition, in order to not misrepresent caller of checkpoint, we should

not allow to trigger async checkpoint for those callers: mount/umount/remount/

freeze/quotactl.