UBUNTU-CVE-2025-68356
In the Linux kernel, the following vulnerability has been resolved: gfs2: Prevent recursive memory reclaim Function new_inode() returns a new inode with inode->i_mapping->gfp_mask set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so allocations in that address space can recurse into filesystem memory reclaim. We don't want that to happen because it can consume a significant amount of stack memory. Worse than that is that it can also deadlock: for example, in several places, gfs2_unstuff_dinode() is called inside filesystem transactions. This calls filemap_grab_folio(), which can allocate a new folio, which can trigger memory reclaim. If memory reclaim recurses into the filesystem and starts another transaction, a deadlock will ensue. To fix these kinds of problems, prevent memory reclaim from recursing into filesystem code by making sure that the gfp_mask of inode address spaces doesn't include __GFP_FS. The "meta" and resource group address spaces were already using GFP_NOFS as their gfp_mask (which doesn't include __GFP_FS). The default value of GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though. To avoid being overly limiting, use the default value and only knock off the __GFP_FS flag. I'm not sure if this will actually make a difference, but it also shouldn't hurt. This patch is loosely based on commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation"). Fixes xfstest generic/273.
02 / AFFECTED SOFTWARE
Affected packages
8 explicit affected versions
10 explicit affected versions
7 explicit affected versions
13 explicit affected versions
26 explicit affected versions
21 explicit affected versions
7 explicit affected versions
8 explicit affected versions
11 explicit affected versions
50 explicit affected versions
6 explicit affected versions
10 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
39 explicit affected versions
26 explicit affected versions
7 explicit affected versions
42 explicit affected versions
13 explicit affected versions
46 explicit affected versions
35 explicit affected versions
18 explicit affected versions
48 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
55 explicit affected versions
1 explicit affected versions
21 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
13 explicit affected versions
51 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
37 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
19 explicit affected versions
12 explicit affected versions
2 explicit affected versions
12 explicit affected versions
44 explicit affected versions
16 explicit affected versions
10 explicit affected versions
29 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
2 explicit affected versions
13 explicit affected versions
42 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
26 explicit affected versions
12 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
43 explicit affected versions
23 explicit affected versions
5 explicit affected versions
43 explicit affected versions
1 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
22 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
2 explicit affected versions
7 explicit affected versions
12 explicit affected versions
1 explicit affected versions
9 explicit affected versions
5 explicit affected versions
10 explicit affected versions
26 explicit affected versions
42 explicit affected versions
37 explicit affected versions
48 explicit affected versions
11 explicit affected versions
2 explicit affected versions
13 explicit affected versions
48 explicit affected versions
16 explicit affected versions
53 explicit affected versions
3 explicit affected versions
7 explicit affected versions
8 explicit affected versions
51 explicit affected versions
9 explicit affected versions
18 explicit affected versions
43 explicit affected versions
12 explicit affected versions
3 explicit affected versions
27 explicit affected versions
45 explicit affected versions
8 explicit affected versions
49 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
45 explicit affected versions
37 explicit affected versions
53 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
10 explicit affected versions
11 explicit affected versions
42 explicit affected versions
8 explicit affected versions
7 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
13 explicit affected versions
43 explicit affected versions
8 explicit affected versions
5 explicit affected versions
10 explicit affected versions
48 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
7 explicit affected versions
11 explicit affected versions
1 explicit affected versions
22 explicit affected versions
41 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: gfs2: Prevent recursive memory reclaim Function new_inode() returns a new inode with inode->i_mapping->gfp_mask set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so allocations in that address space can recurse into filesystem memory reclaim. We don't want that to happen because it can consume a significant amount of stack memory. Worse than that is that it can also deadlock: for example, in several places, gfs2_unstuff_dinode() is called inside filesystem transactions. This calls filemap_grab_folio(), which can allocate a new folio, which can trigger memory reclaim. If memory reclaim recurses into the filesystem and starts another transaction, a deadlock will ensue. To fix these kinds of problems, prevent memory reclaim from recursing into filesystem code by making sure that the gfp_mask of inode address spaces doesn't include __GFP_FS. The "meta" and resource group address spaces were already using GFP_NOFS as their gfp_mask (which doesn't include __GFP_FS). The default value of GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though. To avoid being overly limiting, use the default value and only knock off the __GFP_FS flag. I'm not sure if this will actually make a difference, but it also shouldn't hurt. This patch is loosely based on commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation"). Fixes xfstest generic/273.
05 / REFERENCES
Further evidence
- https://git.kernel.org/stable/c/2c5f4a53476e3cab70adc77b38942c066bd2c17c
- https://git.kernel.org/stable/c/49e7347f4644d031306d56cb4d51e467cbdcbc69
- https://git.kernel.org/stable/c/9c0960ed112398bdb6c60ccf6e6b583bc59acede
- https://git.kernel.org/stable/c/edb2b255618621dc83d0ec23150e16b2c697077f
- https://ubuntu.com/security/CVE-2025-68356
- https://ubuntu.com/security/notices/USN-8094-1
- https://ubuntu.com/security/notices/USN-8094-2
- https://ubuntu.com/security/notices/USN-8094-3
- https://ubuntu.com/security/notices/USN-8094-4
- https://ubuntu.com/security/notices/USN-8094-5
- https://ubuntu.com/security/notices/USN-8152-1
- https://www.cve.org/CVERecord?id=CVE-2025-68356