---
id: CVE-2025-23132
title: 'f2fs: quota: fix to avoid warning in dquot_writeback_dquots()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

  F2FS-fs (dm-59): checkpoint=enable has some unwritten data.

  ------------[ cut here ]------------
  WARNING…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 <
    9ec535db9da76dafa05c89f8b58a0b1d7dddba1c
  - >-
    Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 <
    d7acf0a6c87aa282c86a36dbaa2f92fda88c5884
  - >-
    Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 <
    eb85c2410d6f581e957cd03a644ff6ddbe592af9
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:44:37.526409Z'
published: '2025-04-16'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:19.341Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-23132'
references:
  - url: 'https://git.kernel.org/stable/c/9ec535db9da76dafa05c89f8b58a0b1d7dddba1c'
  - url: 'https://git.kernel.org/stable/c/d7acf0a6c87aa282c86a36dbaa2f92fda88c5884'
  - url: 'https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9'
tags:
  - cve.org
epss: 0.00382
epssPercentile: 0.32016
ingestedAt: '2026-10-15T22:48:25.475Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

F2FS-fs (dm-59): checkpoint=enable has some unwritten data.

------------[ cut here ]------------
WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308
pc : dquot_writeback_dquots+0x2fc/0x308
lr : f2fs_quota_sync+0xcc/0x1c4
Call trace:
dquot_writeback_dquots+0x2fc/0x308
f2fs_quota_sync+0xcc/0x1c4
f2fs_write_checkpoint+0x3d4/0x9b0
f2fs_issue_checkpoint+0x1bc/0x2c0
f2fs_sync_fs+0x54/0x150
f2fs_do_sync_file+0x2f8/0x814
__f2fs_ioctl+0x1960/0x3244
f2fs_ioctl+0x54/0xe0
__arm64_sys_ioctl+0xa8/0xe4
invoke_syscall+0x58/0x114

checkpoint and f2fs_remount may race as below, resulting triggering warning
in dquot_writeback_dquots().

atomic write                                    remount
                                                - do_remount
                                                 - down_write(&sb->s_umount);
                                                  - f2fs_remount
- ioctl
 - f2fs_do_sync_file
  - f2fs_sync_fs
   - f2fs_write_checkpoint
    - block_operations
     - locked = down_read_trylock(&sbi->sb->s_umount)
       : fail to lock due to the write lock was held by remount
                                                 - up_write(&sb->s_umount);
     - f2fs_quota_sync
      - dquot_writeback_dquots
       - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount))
       : trigger warning because s_umount lock was unlocked by remount

If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of
checkpoint has already held s_umount lock, calling dquot_writeback_dquots()
in the context should be safe.

So let's record task to sbi->umount_lock_holder, so that checkpoint can
know whether the lock has held in the context or not by checking current
w/ it.

In addition, in order to not misrepresent caller of checkpoint, we should
not allow to trigger async checkpoint for those callers: mount/umount/remount/
freeze/quotactl.

## Affected

- `Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 < 9ec535db9da76dafa05c89f8b58a0b1d7dddba1c`
- `Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 < d7acf0a6c87aa282c86a36dbaa2f92fda88c5884`
- `Linux >= af033b2aa8a874fd5737fafe90d159136527b5b4 < eb85c2410d6f581e957cd03a644ff6ddbe592af9`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.