CVE-2025-22127

What it actually does

Infinite loop in f2fs_prepare_compress_overwrite() when reading compressed cluster pages encounters IO errors while holding the writepages lock, preventing other writeback tasks from progressing.

Why it matters to the business

File system operations using f2fs compression can hang indefinitely under IO error conditions, causing system-wide writeback stalls and potential denial of service in affected Ceph storage deployments.

How an attack unfolds

An attacker or faulty condition triggers IO errors on f2fs compressed clusters (for example by loading an error table into a dm device), causing prepare_compress_overwrite to loop indefinitely while holding locks; this blocks all concurrent writeback and leads to kernel task hangs.

How to fix it

Upgrade affected Ceph packages to the fixed versions listed (for example ceph 2:19.2.0-55.el9cp and corresponding packages); apply the upstream kernel fix for f2fs_handle_page_eio and early cp_error detection in f2fs_read_multi_pages if rebuilding kernels.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases; reproduce the original xfstests generic/475 workload with compression and error injection to verify no hang occurs; monitor for absence of prolonged mutex contention in __f2fs_write_data_pages.

Typical attack path

1. Mount f2fs filesystem with compression enabled
2. Induce IO errors on compressed data clusters
3. Trigger writeback activity that enters prepare_compress_overwrite
4. Hold writepages lock while looping on error pages
5. Starve other writeback workers causing system hang

How to detect it

Search kernel logs and dmesg for hung_task_timeout messages mentioning __f2fs_write_data_pages or kworker writeback; inspect f2fs mount options for compression and any preceding IO error or dm error table activity.

What your security team should do

• Prioritize upgrade of all listed Ceph packages to the stated fixed versions within the next maintenance window
• Enable f2fs compression only on storage where IO error handling can be monitored
• Review kernel logs for hung_task warnings related to f2fs writeback after deployment