| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49068: btrfs: release correct delalloc amount in direct IO write path |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| btrfs: release correct delalloc amount in direct IO write path |
| |
| Running generic/406 causes the following WARNING in btrfs_destroy_inode() |
| which tells there are outstanding extents left. |
| |
| In btrfs_get_blocks_direct_write(), we reserve a temporary outstanding |
| extents with btrfs_delalloc_reserve_metadata() (or indirectly from |
| btrfs_delalloc_reserve_space(()). We then release the outstanding extents |
| with btrfs_delalloc_release_extents(). However, the "len" can be modified |
| in the COW case, which releases fewer outstanding extents than expected. |
| |
| Fix it by calling btrfs_delalloc_release_extents() for the original length. |
| |
| To reproduce the warning, the filesystem should be 1 GiB. It's |
| triggering a short-write, due to not being able to allocate a large |
| extent and instead allocating a smaller one. |
| |
| WARNING: CPU: 0 PID: 757 at fs/btrfs/inode.c:8848 btrfs_destroy_inode+0x1e6/0x210 [btrfs] |
| Modules linked in: btrfs blake2b_generic xor lzo_compress |
| lzo_decompress raid6_pq zstd zstd_decompress zstd_compress xxhash zram |
| zsmalloc |
| CPU: 0 PID: 757 Comm: umount Not tainted 5.17.0-rc8+ #101 |
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS d55cb5a 04/01/2014 |
| RIP: 0010:btrfs_destroy_inode+0x1e6/0x210 [btrfs] |
| RSP: 0018:ffffc9000327bda8 EFLAGS: 00010206 |
| RAX: 0000000000000000 RBX: ffff888100548b78 RCX: 0000000000000000 |
| RDX: 0000000000026900 RSI: 0000000000000000 RDI: ffff888100548b78 |
| RBP: ffff888100548940 R08: 0000000000000000 R09: ffff88810b48aba8 |
| R10: 0000000000000001 R11: ffff8881004eb240 R12: ffff88810b48a800 |
| R13: ffff88810b48ec08 R14: ffff88810b48ed00 R15: ffff888100490c68 |
| FS: 00007f8549ea0b80(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 00007f854a09e733 CR3: 000000010a2e9003 CR4: 0000000000370eb0 |
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| Call Trace: |
| <TASK> |
| destroy_inode+0x33/0x70 |
| dispose_list+0x43/0x60 |
| evict_inodes+0x161/0x1b0 |
| generic_shutdown_super+0x2d/0x110 |
| kill_anon_super+0xf/0x20 |
| btrfs_kill_super+0xd/0x20 [btrfs] |
| deactivate_locked_super+0x27/0x90 |
| cleanup_mnt+0x12c/0x180 |
| task_work_run+0x54/0x80 |
| exit_to_user_mode_prepare+0x152/0x160 |
| syscall_exit_to_user_mode+0x12/0x30 |
| do_syscall_64+0x42/0x80 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| RIP: 0033:0x7f854a000fb7 |
| |
| The Linux kernel CVE team has assigned CVE-2022-49068 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15.27 with commit 5afd80c393f4e87451f14eefb7f2f24daf434e06 and fixed in 5.15.35 with commit 07cacfd9d9dc134557ac8866c73d570a59b3d1f3 |
| Issue introduced in 5.17 with commit f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f and fixed in 5.17.4 with commit a04d37ddfe4be431b9e52e8504490376ab0a39a4 |
| Issue introduced in 5.17 with commit f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f and fixed in 5.18 with commit 6d82ad13c4110e73c7b0392f00534a1502a1b520 |
| Issue introduced in 5.16.13 with commit 96f1be29492d9e2fb97bb27f824478ab8cd3ab86 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49068 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/btrfs/inode.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/07cacfd9d9dc134557ac8866c73d570a59b3d1f3 |
| https://git.kernel.org/stable/c/a04d37ddfe4be431b9e52e8504490376ab0a39a4 |
| https://git.kernel.org/stable/c/6d82ad13c4110e73c7b0392f00534a1502a1b520 |
