CVE-2022-48833

published 2024-07-16

CVE-2022-48833: In the Linux kernel, the following vulnerability has been resolved: btrfs: skip reserved bytes warning on unmount after log cleanup failure After the recent…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

btrfs: skip reserved bytes warning on unmount after log cleanup failure

After the recent changes made by commit c2e39305299f01 ("btrfs: clear
extent buffer uptodate when we fail to write it") and its followup fix,
commit 651740a5024117 ("btrfs: check WRITE_ERR when trying to read an
extent buffer"), we can now end up not cleaning up space reservations of
log tree extent buffers after a transaction abort happens, as well as not
cleaning up still dirty extent buffers.

This happens because if writeback for a log tree extent buffer failed,
then we have cleared the bit EXTENT_BUFFER_UPTODATE from the extent buffer
and we have also set the bit EXTENT_BUFFER_WRITE_ERR on it. Later on,
when trying to free the log tree with free_log_tree(), which iterates
over the tree, we can end up getting an -EIO error when trying to read
a node or a leaf, since read_extent_buffer_pages() returns -EIO if an
extent buffer does not have EXTENT_BUFFER_UPTODATE set and has the
EXTENT_BUFFER_WRITE_ERR bit set. Getting that -EIO means that we return
immediately as we can not iterate over the entire tree.

In that case we never update the reserved space for an extent buffer in
the respective block group and space_info object.

When this happens we get the following traces when unmounting the fs:

[174957.284509] BTRFS: error (device dm-0) in cleanup_transaction:1913: errno=-5 IO failure
[174957.286497] BTRFS: error (device dm-0) in free_log_tree:3420: errno=-5 IO failure
[174957.399379] ------------[ cut here ]------------
[174957.402497] WARNING: CPU: 2 PID: 3206883 at fs/btrfs/block-group.c:127 btrfs_put_block_group+0x77/0xb0 [btrfs]
[174957.407523] Modules linked in: btrfs overlay dm_zero (...)
[174957.424917] CPU: 2 PID: 3206883 Comm: umount Tainted: G W 5.16.0-rc5-btrfs-next-109 #1
[174957.426689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[174957.4

Affected

24 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.16.18-1 (bookworm)	linux 5.16.18-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 0338e448b90527d46e6debe9f95f8a117706a835 < 4c5d94990fa2fd609360ecd0f7e183212a7d115c	4c5d94990fa2fd609360ecd0f7e183212a7d115c
linux	linux	>= 5.10.85 < 5.11	5.11
linux	linux	>= 5.15.8 < 5.15.31	5.15.31
linux	linux	>= 5.4.165 < 5.5	5.5
linux	linux	>= 651740a502411793327e2f0741104749c4eedcd1 < 40cdc509877bacb438213b83c7541c5e24a1d9ec	40cdc509877bacb438213b83c7541c5e24a1d9ec
linux	linux	>= c2e39305299f0118298c2201f6d6cc7d3485f29e < 44557a8f539a822c91238c1f95a95f98a5093d82	44557a8f539a822c91238c1f95a95f98a5093d82
linux	linux	>= c2e39305299f0118298c2201f6d6cc7d3485f29e < 40cdc509877bacb438213b83c7541c5e24a1d9ec	40cdc509877bacb438213b83c7541c5e24a1d9ec
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.16.18-1	5.16.18-1
linux	linux_kernel	>= 0 < 5.16.18-1	5.16.18-1
linux	linux_kernel	>= 0 < 5.16.18-1	5.16.18-1
linux	linux_kernel	>= 5.10.85 < 5.11	5.11
linux	linux_kernel	>= 5.15.11 < 5.16	5.16
linux	linux_kernel	>= 5.15.8 < 5.15.31	5.15.31
linux	linux_kernel	>= 5.16.1 < 5.16.17	5.16.17
linux	linux_kernel	>= 5.18 < 5.17	5.17
linux	linux_kernel	>= 5.4.165 < 5.5	5.5
msrc	cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.