cvelist/2022/48xxx/CVE-2022-48902.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2022-48902",
        "ASSIGNER": "cve@kernel.org",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not WARN_ON() if we have PageError set\n\nWhenever we do any extent buffer operations we call\nassert_eb_page_uptodate() to complain loudly if we're operating on an\nnon-uptodate page.  Our overnight tests caught this warning earlier this\nweek\n\n  WARNING: CPU: 1 PID: 553508 at fs/btrfs/extent_io.c:6849 assert_eb_page_uptodate+0x3f/0x50\n  CPU: 1 PID: 553508 Comm: kworker/u4:13 Tainted: G        W         5.17.0-rc3+ #564\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  Workqueue: btrfs-cache btrfs_work_helper\n  RIP: 0010:assert_eb_page_uptodate+0x3f/0x50\n  RSP: 0018:ffffa961440a7c68 EFLAGS: 00010246\n  RAX: 0017ffffc0002112 RBX: ffffe6e74453f9c0 RCX: 0000000000001000\n  RDX: ffffe6e74467c887 RSI: ffffe6e74453f9c0 RDI: ffff8d4c5efc2fc0\n  RBP: 0000000000000d56 R08: ffff8d4d4a224000 R09: 0000000000000000\n  R10: 00015817fa9d1ef0 R11: 000000000000000c R12: 00000000000007b1\n  R13: ffff8d4c5efc2fc0 R14: 0000000001500000 R15: 0000000001cb1000\n  FS:  0000000000000000(0000) GS:ffff8d4dbbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007ff31d3448d8 CR3: 0000000118be8004 CR4: 0000000000370ee0\n  Call Trace:\n\n   extent_buffer_test_bit+0x3f/0x70\n   free_space_test_bit+0xa6/0xc0\n   load_free_space_tree+0x1f6/0x470\n   caching_thread+0x454/0x630\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? lock_release+0x1f0/0x2d0\n   btrfs_work_helper+0xf2/0x3e0\n   ? lock_release+0x1f0/0x2d0\n   ? finish_task_switch.isra.0+0xf9/0x3a0\n   process_one_work+0x26d/0x580\n   ? process_one_work+0x580/0x580\n   worker_thread+0x55/0x3b0\n   ? process_one_work+0x580/0x580\n   kthread+0xf0/0x120\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork+0x1f/0x30\n\nThis was partially fixed by c2e39305299f01 (\"btrfs: clear extent buffer\nuptodate when we fail to write it\"), however all that fix did was keep\nus from finding extent buffers after a failed writeout.  It didn't keep\nus from continuing to use a buffer that we already had found.\n\nIn this case we're searching the commit root to cache the block group,\nso we can start committing the transaction and switch the commit root\nand then start writing.  After the switch we can look up an extent\nbuffer that hasn't been written yet and start processing that block\ngroup.  Then we fail to write that block out and clear Uptodate on the\npage, and then we start spewing these errors.\n\nNormally we're protected by the tree lock to a certain degree here.  If\nwe read a block we have that block read locked, and we block the writer\nfrom locking the block before we submit it for the write.  However this\nisn't necessarily fool proof because the read could happen before we do\nthe submit_bio and after we locked and unlocked the extent buffer.\n\nAlso in this particular case we have path->skip_locking set, so that\nwon't save us here.  We'll simply get a block that was valid when we\nread it, but became invalid while we were using it.\n\nWhat we really want is to catch the case where we've \"read\" a block but\nit's not marked Uptodate.  On read we ClearPageError(), so if we're\n!Uptodate and !Error we know we didn't do the right thing for reading\nthe page.\n\nFix this by checking !Uptodate && !Error, this way we will not complain\nif our buffer gets invalidated while we're using it, and we'll maintain\nthe spirit of the check which is to make sure we have a fully in-cache\nblock while we're messing with it."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "n/a"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Linux",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Linux",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_name": "1da177e4c3f4",
                                            "version_value": "e00077aa439f"
                                        },
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "version": "5.15.27",
                                                        "lessThanOrEqual": "5.15.*",
                                                        "status": "unaffected",
                                                        "versionType": "semver"
                                                    },
                                                    {
                                                        "version": "5.16.13",
                                                        "lessThanOrEqual": "5.16.*",
                                                        "status": "unaffected",
                                                        "versionType": "semver"
                                                    },
                                                    {
                                                        "version": "5.17",
                                                        "lessThanOrEqual": "*",
                                                        "status": "unaffected",
                                                        "versionType": "original_commit_for_fix"
                                                    }
                                                ],
                                                "defaultStatus": "affected"
                                            }
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://git.kernel.org/stable/c/e00077aa439f0e8f416699fa4e9600db6583db70",
                "refsource": "MISC",
                "name": "https://git.kernel.org/stable/c/e00077aa439f0e8f416699fa4e9600db6583db70"
            },
            {
                "url": "https://git.kernel.org/stable/c/9efcc83b33b576302147634eca9bece8e3737e34",
                "refsource": "MISC",
                "name": "https://git.kernel.org/stable/c/9efcc83b33b576302147634eca9bece8e3737e34"
            },
            {
                "url": "https://git.kernel.org/stable/c/a50e1fcbc9b85fd4e95b89a75c0884cb032a3e06",
                "refsource": "MISC",
                "name": "https://git.kernel.org/stable/c/a50e1fcbc9b85fd4e95b89a75c0884cb032a3e06"
            }
        ]
    },
    "generator": {
        "engine": "bippy-9e1c9544281a"
    }
}