{"id":70470,"date":"2025-09-18T20:32:13","date_gmt":"2025-09-18T17:02:13","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2023-53447-f2fs-dont-reset-unchangable-mount-option-in-f2fs_remount\/"},"modified":"2025-09-18T20:32:13","modified_gmt":"2025-09-18T17:02:13","slug":"cve-2023-53447-f2fs-dont-reset-unchangable-mount-option-in-f2fs_remount","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2023-53447-f2fs-dont-reset-unchangable-mount-option-in-f2fs_remount\/","title":{"rendered":"CVE-2023-53447 – f2fs: don’t reset unchangable mount option in f2fs_remount()"},"content":{"rendered":"

CVE ID : <\/strong>CVE-2023-53447
\n
\nPublished : <\/strong> Sept. 18, 2025, 4:15 p.m. | 45\u00a0minutes ago
\n
\nDescription : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n

f2fs: don’t reset unchangable mount option in f2fs_remount()<\/p>\n

syzbot reports a bug as below:<\/p>\n

general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN
\nRIP: 0010:__lock_acquire+0x69\/0x2000 kernel\/locking\/lockdep.c:4942
\nCall Trace:
\n lock_acquire+0x1e3\/0x520 kernel\/locking\/lockdep.c:5691
\n __raw_write_lock include\/linux\/rwlock_api_smp.h:209 [inline]\n _raw_write_lock+0x2e\/0x40 kernel\/locking\/spinlock.c:300
\n __drop_extent_tree+0x3ac\/0x660 fs\/f2fs\/extent_cache.c:1100
\n f2fs_drop_extent_tree+0x17\/0x30 fs\/f2fs\/extent_cache.c:1116
\n f2fs_insert_range+0x2d5\/0x3c0 fs\/f2fs\/file.c:1664
\n f2fs_fallocate+0x4e4\/0x6d0 fs\/f2fs\/file.c:1838
\n vfs_fallocate+0x54b\/0x6b0 fs\/open.c:324
\n ksys_fallocate fs\/open.c:347 [inline]\n __do_sys_fallocate fs\/open.c:355 [inline]\n __se_sys_fallocate fs\/open.c:353 [inline]\n __x64_sys_fallocate+0xbd\/0x100 fs\/open.c:353
\n do_syscall_x64 arch\/x86\/entry\/common.c:50 [inline]\n do_syscall_64+0x41\/0xc0 arch\/x86\/entry\/common.c:80
\n entry_SYSCALL_64_after_hwframe+0x63\/0xcd<\/p>\n

The root cause is race condition as below:
\n– since it tries to remount rw filesystem, so that do_remount won’t
\ncall sb_prepare_remount_readonly to block fallocate, there may be race
\ncondition in between remount and fallocate.
\n– in f2fs_remount(), default_options() will reset mount option to default
\none, and then update it based on result of parse_options(), so there is
\na hole which race condition can happen.<\/p>\n

Thread A\t\t\tThread B
\n– f2fs_fill_super
\n – parse_options
\n – clear_opt(READ_EXTENT_CACHE)<\/p>\n

– f2fs_remount
\n – default_options
\n – set_opt(READ_EXTENT_CACHE)
\n\t\t\t\t– f2fs_fallocate
\n\t\t\t\t – f2fs_insert_range
\n\t\t\t\t – f2fs_drop_extent_tree
\n\t\t\t\t – __drop_extent_tree
\n\t\t\t\t – __may_extent_tree
\n\t\t\t\t – test_opt(READ_EXTENT_CACHE) return true
\n\t\t\t\t – write_lock(&et->lock) access NULL pointer
\n – parse_options
\n – clear_opt(READ_EXTENT_CACHE)
\n
\nSeverity:<\/strong> 0.0 | NA
\n
\nVisit the link for more details, such as CVSS details, affected products, timeline, and more…<\/p>\n","protected":false},"excerpt":{"rendered":"

CVE ID : CVE-2023-53447 Published : Sept. 18, 2025, 4:15 p.m. | 45\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: f2fs: don’t reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:__lock_acquire+0x69\/0x2000 …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70470","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70470"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70470\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}