CVE-2022-49033 - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()

Back Back to CVE browser

MEDIUM

btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()

Published Oct 21, 2024

5.5

MEDIUM

CVSS 3.1

EPSS 0.25%

Description

Syzkaller reported BUG as follows:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update_qgroup_limit_item+0xe1/0x390 btrfs_qgroup_inherit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_ioctl_snap_create_v2+0x25a/0x520 btrfs_ioctl+0x2a1c/0x5ce0 __x64_sys_ioctl+0x193/0x200 do_syscall_64+0x35/0x80

Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in btrfs_run_qgroups() later outside of the spinlock context.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.1
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.1
- Version
  4.14.301
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.268
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.335
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.158
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.82
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.226
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.0.12
  Status
  unaffected
  Constraints
  <=6.0.*
- Version
  6.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.1	affected	-
0	unaffected	<4.1
4.14.301	unaffected	<=4.14.*
4.19.268	unaffected	<=4.19.*
4.9.335	unaffected	<=4.9.*
5.10.158	unaffected	<=5.10.*
5.15.82	unaffected	<=5.15.*
5.4.226	unaffected	<=5.4.*
6.0.12	unaffected	<=6.0.*
6.1	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (13)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-49033		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2320795		Issue Tracking
https://git.kernel.org/stable/c/01d7c41eac9129fba80d8aed0060caab4a7dbe09		Patch
https://git.kernel.org/stable/c/044da1a371a0da579e805e89c96865f62d8f6f69		Patch
https://git.kernel.org/stable/c/3c98e91be6aea4c7acf09da6eb0c107ea9186bb5		Patch
https://git.kernel.org/stable/c/588ae4fdd8b11788a797776b10d6c44ae12bc133		Patch
https://git.kernel.org/stable/c/89840b12c8fad7200eb6478525c13261512c01be		Patch
https://git.kernel.org/stable/c/8eb912af525042a7365295eb62f6d5270c2a6462		Patch
https://git.kernel.org/stable/c/f4b930a1602b05e77fee31f9616599b25e910a86		Patch
https://git.kernel.org/stable/c/f7e942b5bb35d8e3af54053d19a6bf04143a3955		Patch
https://lore.kernel.org/linux-cve-announce/2024102156-CVE-2022-49033-a8c6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49033
https://www.cve.org/CVERecord?id=CVE-2022-49033