CVE-2022-49547

published 2025-02-26

CVE-2022-49547: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between concurrent dio writes when low on free data space When…

Priority P4 22 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock between concurrent dio writes when low on free data space

When reserving data space for a direct IO write we can end up deadlocking
if we have multiple tasks attempting a write to the same file range, there
are multiple extents covered by that file range, we are low on available
space for data and the writes don't expand the inode's i_size.

The deadlock can happen like this:

1) We have a file with an i_size of 1M, at offset 0 it has an extent with
a size of 128K and at offset 128K it has another extent also with a
size of 128K;

2) Task A does a direct IO write against file range [0, 256K), and because
the write is within the i_size boundary, it takes the inode's lock (VFS
level) in shared mode;

3) Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and
then gets the extent map for the extent covering the range [0, 128K).
At btrfs_get_blocks_direct_write(), it creates an ordered extent for
that file range ([0, 128K));

4) Before returning from btrfs_dio_iomap_begin(), it unlocks the file
range [0, 256K);

5) Task A executes btrfs_dio_iomap_begin() again, this time for the file
range [128K, 256K), and locks the file range [128K, 256K);

6) Task B starts a direct IO write against file range [0, 256K) as well.
It also locks the inode in shared mode, as it's within the i_size limit,
and then tries to lock file range [0, 256K). It is able to lock the
subrange [0, 128K) but then blocks waiting for the range [128K, 256K),
as it is currently locked by task A;

7) Task A enters btrfs_get_blocks_direct_write() and tries to reserve data
space. Because we are low on available free space, it triggers the
async data reclaim task, and waits for it to reserve data space;

8) The async reclaim task decides to wait for all existing ordered extents
to complete (through btrfs_wait_ordered_roots()).
It finds the ordered extent previously created by task A for the file
range [0, 128

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.5-1 (bookworm)	linux 5.18.5-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 5.15.27 < 5.16	5.16
linux	linux	>= 5.16.13 < 5.17	5.17
linux	linux	>= f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f < cfae6f765b3c40882ee90dae8fbf9325c8de9c35	cfae6f765b3c40882ee90dae8fbf9325c8de9c35
linux	linux	>= f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f < f5585f4f0ef5b17026bbd60fbff6fcc91b99d5bf	f5585f4f0ef5b17026bbd60fbff6fcc91b99d5bf
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 5.15.27 < 5.16	5.16
linux	linux_kernel	>= 5.16.13 < 5.18.3	5.18.3
msrc	cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-667