nvd-json-data-feeds/CVE-2022/CVE-2022-490xx/CVE-2022-49079.json

{
  "id": "CVE-2022-49079",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-26T07:00:45.250",
  "lastModified": "2025-02-26T07:00:45.250",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone\n\nbtrfs_can_activate_zone() can be called with the device_list_mutex already\nheld, which will lead to a deadlock:\n\ninsert_dev_extents() // Takes device_list_mutex\n`-> insert_dev_extent()\n `-> btrfs_insert_empty_item()\n  `-> btrfs_insert_empty_items()\n   `-> btrfs_search_slot()\n    `-> btrfs_cow_block()\n     `-> __btrfs_cow_block()\n      `-> btrfs_alloc_tree_block()\n       `-> btrfs_reserve_extent()\n        `-> find_free_extent()\n         `-> find_free_extent_update_loop()\n          `-> can_allocate_chunk()\n           `-> btrfs_can_activate_zone() // Takes device_list_mutex again\n\nInstead of using the RCU on fs_devices->device_list we\ncan use fs_devices->alloc_list, protected by the chunk_mutex to traverse\nthe list of active devices.\n\nWe are in the chunk allocation thread. The newer chunk allocation\nhappens from the devices in the fs_device->alloc_list protected by the\nchunk_mutex.\n\n  btrfs_create_chunk()\n    lockdep_assert_held(&info->chunk_mutex);\n    gather_device_info\n      list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list)\n\nAlso, a device that reappears after the mount won't join the alloc_list\nyet and, it will be in the dev_list, which we don't want to consider in\nthe context of the chunk alloc.\n\n  [15.166572] WARNING: possible recursive locking detected\n  [15.167117] 5.17.0-rc6-dennis #79 Not tainted\n  [15.167487] --------------------------------------------\n  [15.167733] kworker/u8:3/146 is trying to acquire lock:\n  [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.167733]\n  [15.167733] but task is already holding lock:\n  [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n  [15.167733]\n  [15.167733] other info that might help us debug this:\n  [15.167733]  Possible unsafe locking scenario:\n  [15.167733]\n  [15.171834]        CPU0\n  [15.171834]        ----\n  [15.171834]   lock(&fs_devs->device_list_mutex);\n  [15.171834]   lock(&fs_devs->device_list_mutex);\n  [15.171834]\n  [15.171834]  *** DEADLOCK ***\n  [15.171834]\n  [15.171834]  May be due to missing lock nesting notation\n  [15.171834]\n  [15.171834] 5 locks held by kworker/u8:3/146:\n  [15.171834]  #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n  [15.171834]  #1: ffffc9000067be80 ((work_completion)(&fs_info->async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n  [15.176244]  #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs]\n  [15.176244]  #3: ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n  [15.176244]  #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs]\n  [15.179641]\n  [15.179641] stack backtrace:\n  [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79\n  [15.179641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014\n  [15.179641] Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  [15.179641] Call Trace:\n  [15.179641]  <TASK>\n  [15.179641]  dump_stack_lvl+0x45/0x59\n  [15.179641]  __lock_acquire.cold+0x217/0x2b2\n  [15.179641]  lock_acquire+0xbf/0x2b0\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  __mutex_lock+0x8e/0x970\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? lock_is_held_type+0xd7/0x130\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? _raw_spin_unlock+0x24/0x40\n  [15.183838]  ? btrfs_get_alloc_profile+0x106/0x230 [btrfs]\n  [15.187601]  btrfs_reserve_extent+0x131/0x260 [btrfs]\n  [15.\n---truncat
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: zoned: atravesar dispositivos bajo chunk_mutex en btrfs_can_activate_zone btrfs_can_activate_zone() se puede llamar con el device_list_mutex ya retenido, lo que provocar\u00e1 un bloqueo: insert_dev_extents() // Toma device_list_mutex `-&gt; insert_dev_extent() `-&gt; btrfs_insert_empty_item() `-&gt; btrfs_insert_empty_items() `-&gt; btrfs_search_slot() `-&gt; btrfs_cow_block() `-&gt; __btrfs_cow_block() `-&gt; btrfs_alloc_tree_block() `-&gt; btrfs_reserve_extent() `-&gt; find_free_extent() `-&gt; find_free_extent_update_loop() `-&gt; can_allocate_chunk() `-&gt; btrfs_can_activate_zone() // Toma device_list_mutex nuevamente En lugar de usar la RCU en fs_devices-&gt;device_list podemos usar fs_devices-&gt;alloc_list, protegido por chunk_mutex para recorrer la lista de dispositivos activos. Estamos en el hilo de asignaci\u00f3n de fragmentos. La asignaci\u00f3n de fragmentos m\u00e1s nueva ocurre desde los dispositivos en fs_device-&gt;alloc_list protegidos por chunk_mutex. btrfs_create_chunk() lockdep_assert_held(&amp;info-&gt;chunk_mutex); gather_device_info list_for_each_entry(device, &amp;fs_devices-&gt;alloc_list, dev_alloc_list) Adem\u00e1s, un dispositivo que reaparece despu\u00e9s del montaje no se unir\u00e1 a alloc_list todav\u00eda y estar\u00e1 en dev_list, que no queremos considerar en el contexto de la asignaci\u00f3n de fragmentos. [15.166572] ADVERTENCIA: se detect\u00f3 un posible bloqueo recursivo [15.167117] 5.17.0-rc6-dennis #79 No contaminado [15.167487] -------------------------------------------- [15.167733] kworker/u8:3/146 est\u00e1 intentando adquirir el bloqueo: [15.167733] ffff888102962ee0 (&amp;fs_devs-&gt;device_list_mutex){+.+.}-{3:3}, en: find_free_extent+0x15a/0x14f0 [btrfs] [15.167733] [15.167733] pero la tarea ya tiene el bloqueo: [15.167733] ffff888102962ee0 (&amp;fs_devs-&gt;device_list_mutex){+.+.}-{3:3}, en: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs] [15.167733] [15.167733] otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: [15.167733] Posible escenario de bloqueo inseguro: [15.167733] [15.171834] CPU0 [15.171834] ---- [15.171834] lock(&amp;fs_devs-&gt;device_list_mutex); [15.171834] lock(&amp;fs_devs-&gt;device_list_mutex); [15.171834] [15.171834] *** BLOQUEO INTERMEDIO *** [15.171834] [15.171834] Puede deberse a la falta de notaci\u00f3n de anidamiento de bloqueos [15.171834] [15.171834] 5 bloqueos retenidos por kworker/u8:3/146: [15.171834] #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, en: process_one_work+0x1c3/0x5a0 [15.171834] #1: ffffc9000067be80 ((work_completion)(&amp;fs_info-&gt;async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0 [15.176244] #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs] [15.176244] #3: ffff888102962ee0 (&amp;fs_devs-&gt;device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs] [15.176244] #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs] [15.179641] [15.179641] stack backtrace: [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79 [15.179641] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 01/04/2014 [15.179641] Cola de trabajo: events_unbound btrfs_async_reclaim_data_space [btrfs] [15.179641] Rastreo de llamadas: [15.179641]  [15.179641] dump_stack_lvl+0x45/0x59 [15.179641] __lock_acquire.cold+0x217/0x2b2 [15.179641] lock_acquire+0xbf/0x2b0 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] __mutex_lock+0x8e/0x970 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? lock_is_held_type+0xd7/0x130 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? _raw_spin_unlock+0x24/0x40 [15.183838] ? btrfs_get_alloc_profile+0x106/0x230 [btrfs] [15.187601] btrfs_reserve_extent+0x131/0x260 [btrfs] [15. ---trunca
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/09e65ae515af2b24d6dc23af21719a3b41de83e5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0b9e66762aa0cda2a9c2d5542d64e04dac528fa6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/142f822bd945a7be442a2916ec6167cc102c4183",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}