FKIE_CVE-2022-49079
Vulnerability from fkie_nvd - Published: 2025-02-26 07:00 - Updated: 2026-06-17 05:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone
btrfs_can_activate_zone() can be called with the device_list_mutex already
held, which will lead to a deadlock:
insert_dev_extents() // Takes device_list_mutex
`-> insert_dev_extent()
`-> btrfs_insert_empty_item()
`-> btrfs_insert_empty_items()
`-> btrfs_search_slot()
`-> btrfs_cow_block()
`-> __btrfs_cow_block()
`-> btrfs_alloc_tree_block()
`-> btrfs_reserve_extent()
`-> find_free_extent()
`-> find_free_extent_update_loop()
`-> can_allocate_chunk()
`-> btrfs_can_activate_zone() // Takes device_list_mutex again
Instead of using the RCU on fs_devices->device_list we
can use fs_devices->alloc_list, protected by the chunk_mutex to traverse
the list of active devices.
We are in the chunk allocation thread. The newer chunk allocation
happens from the devices in the fs_device->alloc_list protected by the
chunk_mutex.
btrfs_create_chunk()
lockdep_assert_held(&info->chunk_mutex);
gather_device_info
list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list)
Also, a device that reappears after the mount won't join the alloc_list
yet and, it will be in the dev_list, which we don't want to consider in
the context of the chunk alloc.
[15.166572] WARNING: possible recursive locking detected
[15.167117] 5.17.0-rc6-dennis #79 Not tainted
[15.167487] --------------------------------------------
[15.167733] kworker/u8:3/146 is trying to acquire lock:
[15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: find_free_extent+0x15a/0x14f0 [btrfs]
[15.167733]
[15.167733] but task is already holding lock:
[15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]
[15.167733]
[15.167733] other info that might help us debug this:
[15.167733] Possible unsafe locking scenario:
[15.167733]
[15.171834] CPU0
[15.171834] ----
[15.171834] lock(&fs_devs->device_list_mutex);
[15.171834] lock(&fs_devs->device_list_mutex);
[15.171834]
[15.171834] *** DEADLOCK ***
[15.171834]
[15.171834] May be due to missing lock nesting notation
[15.171834]
[15.171834] 5 locks held by kworker/u8:3/146:
[15.171834] #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0
[15.171834] #1: ffffc9000067be80 ((work_completion)(&fs_info->async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0
[15.176244] #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs]
[15.176244] #3: ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]
[15.176244] #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs]
[15.179641]
[15.179641] stack backtrace:
[15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79
[15.179641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014
[15.179641] Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]
[15.179641] Call Trace:
[15.179641] <TASK>
[15.179641] dump_stack_lvl+0x45/0x59
[15.179641] __lock_acquire.cold+0x217/0x2b2
[15.179641] lock_acquire+0xbf/0x2b0
[15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]
[15.183838] __mutex_lock+0x8e/0x970
[15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]
[15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]
[15.183838] ? lock_is_held_type+0xd7/0x130
[15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]
[15.183838] find_free_extent+0x15a/0x14f0 [btrfs]
[15.183838] ? _raw_spin_unlock+0x24/0x40
[15.183838] ? btrfs_get_alloc_profile+0x106/0x230 [btrfs]
[15.187601] btrfs_reserve_extent+0x131/0x260 [btrfs]
[15.
---truncated---
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| linux | linux_kernel | * | |
| linux | linux_kernel | * | |
| linux | linux_kernel | 5.18 |
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zoned.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09e65ae515af2b24d6dc23af21719a3b41de83e5",
"status": "affected",
"version": "a85f05e59bc15a83ad910dbcb71df5ad8fa77295",
"versionType": "git"
},
{
"lessThan": "142f822bd945a7be442a2916ec6167cc102c4183",
"status": "affected",
"version": "a85f05e59bc15a83ad910dbcb71df5ad8fa77295",
"versionType": "git"
},
{
"lessThan": "0b9e66762aa0cda2a9c2d5542d64e04dac528fa6",
"status": "affected",
"version": "a85f05e59bc15a83ad910dbcb71df5ad8fa77295",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zoned.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.16.*",
"status": "unaffected",
"version": "5.16.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.17.*",
"status": "unaffected",
"version": "5.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABBBA66E-0244-4621-966B-9790AF1EEB00",
"versionEndExcluding": "5.16.20",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE420AC7-1E59-4398-B84F-71F4B4337762",
"versionEndExcluding": "5.17.3",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6AD94161-84BB-42E6-9882-4FC0C42E9FC1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone\n\nbtrfs_can_activate_zone() can be called with the device_list_mutex already\nheld, which will lead to a deadlock:\n\ninsert_dev_extents() // Takes device_list_mutex\n`-\u003e insert_dev_extent()\n `-\u003e btrfs_insert_empty_item()\n `-\u003e btrfs_insert_empty_items()\n `-\u003e btrfs_search_slot()\n `-\u003e btrfs_cow_block()\n `-\u003e __btrfs_cow_block()\n `-\u003e btrfs_alloc_tree_block()\n `-\u003e btrfs_reserve_extent()\n `-\u003e find_free_extent()\n `-\u003e find_free_extent_update_loop()\n `-\u003e can_allocate_chunk()\n `-\u003e btrfs_can_activate_zone() // Takes device_list_mutex again\n\nInstead of using the RCU on fs_devices-\u003edevice_list we\ncan use fs_devices-\u003ealloc_list, protected by the chunk_mutex to traverse\nthe list of active devices.\n\nWe are in the chunk allocation thread. The newer chunk allocation\nhappens from the devices in the fs_device-\u003ealloc_list protected by the\nchunk_mutex.\n\n btrfs_create_chunk()\n lockdep_assert_held(\u0026info-\u003echunk_mutex);\n gather_device_info\n list_for_each_entry(device, \u0026fs_devices-\u003ealloc_list, dev_alloc_list)\n\nAlso, a device that reappears after the mount won\u0027t join the alloc_list\nyet and, it will be in the dev_list, which we don\u0027t want to consider in\nthe context of the chunk alloc.\n\n [15.166572] WARNING: possible recursive locking detected\n [15.167117] 5.17.0-rc6-dennis #79 Not tainted\n [15.167487] --------------------------------------------\n [15.167733] kworker/u8:3/146 is trying to acquire lock:\n [15.167733] ffff888102962ee0 (\u0026fs_devs-\u003edevice_list_mutex){+.+.}-{3:3}, at: find_free_extent+0x15a/0x14f0 [btrfs]\n [15.167733]\n [15.167733] but task is already holding lock:\n [15.167733] ffff888102962ee0 (\u0026fs_devs-\u003edevice_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n [15.167733]\n [15.167733] other info that might help us debug this:\n [15.167733] Possible unsafe locking scenario:\n [15.167733]\n [15.171834] CPU0\n [15.171834] ----\n [15.171834] lock(\u0026fs_devs-\u003edevice_list_mutex);\n [15.171834] lock(\u0026fs_devs-\u003edevice_list_mutex);\n [15.171834]\n [15.171834] *** DEADLOCK ***\n [15.171834]\n [15.171834] May be due to missing lock nesting notation\n [15.171834]\n [15.171834] 5 locks held by kworker/u8:3/146:\n [15.171834] #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n [15.171834] #1: ffffc9000067be80 ((work_completion)(\u0026fs_info-\u003easync_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n [15.176244] #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs]\n [15.176244] #3: ffff888102962ee0 (\u0026fs_devs-\u003edevice_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n [15.176244] #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs]\n [15.179641]\n [15.179641] stack backtrace:\n [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79\n [15.179641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014\n [15.179641] Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n [15.179641] Call Trace:\n [15.179641] \u003cTASK\u003e\n [15.179641] dump_stack_lvl+0x45/0x59\n [15.179641] __lock_acquire.cold+0x217/0x2b2\n [15.179641] lock_acquire+0xbf/0x2b0\n [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]\n [15.183838] __mutex_lock+0x8e/0x970\n [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]\n [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]\n [15.183838] ? lock_is_held_type+0xd7/0x130\n [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs]\n [15.183838] find_free_extent+0x15a/0x14f0 [btrfs]\n [15.183838] ? _raw_spin_unlock+0x24/0x40\n [15.183838] ? btrfs_get_alloc_profile+0x106/0x230 [btrfs]\n [15.187601] btrfs_reserve_extent+0x131/0x260 [btrfs]\n [15.\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: zoned: atravesar dispositivos bajo chunk_mutex en btrfs_can_activate_zone btrfs_can_activate_zone() se puede llamar con el device_list_mutex ya retenido, lo que provocar\u00e1 un bloqueo: insert_dev_extents() // Toma device_list_mutex `-\u0026gt; insert_dev_extent() `-\u0026gt; btrfs_insert_empty_item() `-\u0026gt; btrfs_insert_empty_items() `-\u0026gt; btrfs_search_slot() `-\u0026gt; btrfs_cow_block() `-\u0026gt; __btrfs_cow_block() `-\u0026gt; btrfs_alloc_tree_block() `-\u0026gt; btrfs_reserve_extent() `-\u0026gt; find_free_extent() `-\u0026gt; find_free_extent_update_loop() `-\u0026gt; can_allocate_chunk() `-\u0026gt; btrfs_can_activate_zone() // Toma device_list_mutex nuevamente En lugar de usar la RCU en fs_devices-\u0026gt;device_list podemos usar fs_devices-\u0026gt;alloc_list, protegido por chunk_mutex para recorrer la lista de dispositivos activos. Estamos en el hilo de asignaci\u00f3n de fragmentos. La asignaci\u00f3n de fragmentos m\u00e1s nueva ocurre desde los dispositivos en fs_device-\u0026gt;alloc_list protegidos por chunk_mutex. btrfs_create_chunk() lockdep_assert_held(\u0026amp;info-\u0026gt;chunk_mutex); gather_device_info list_for_each_entry(device, \u0026amp;fs_devices-\u0026gt;alloc_list, dev_alloc_list) Adem\u00e1s, un dispositivo que reaparece despu\u00e9s del montaje no se unir\u00e1 a alloc_list todav\u00eda y estar\u00e1 en dev_list, que no queremos considerar en el contexto de la asignaci\u00f3n de fragmentos. [15.166572] ADVERTENCIA: se detect\u00f3 un posible bloqueo recursivo [15.167117] 5.17.0-rc6-dennis #79 No contaminado [15.167487] -------------------------------------------- [15.167733] kworker/u8:3/146 est\u00e1 intentando adquirir el bloqueo: [15.167733] ffff888102962ee0 (\u0026amp;fs_devs-\u0026gt;device_list_mutex){+.+.}-{3:3}, en: find_free_extent+0x15a/0x14f0 [btrfs] [15.167733] [15.167733] pero la tarea ya tiene el bloqueo: [15.167733] ffff888102962ee0 (\u0026amp;fs_devs-\u0026gt;device_list_mutex){+.+.}-{3:3}, en: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs] [15.167733] [15.167733] otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: [15.167733] Posible escenario de bloqueo inseguro: [15.167733] [15.171834] CPU0 [15.171834] ---- [15.171834] lock(\u0026amp;fs_devs-\u0026gt;device_list_mutex); [15.171834] lock(\u0026amp;fs_devs-\u0026gt;device_list_mutex); [15.171834] [15.171834] *** BLOQUEO INTERMEDIO *** [15.171834] [15.171834] Puede deberse a la falta de notaci\u00f3n de anidamiento de bloqueos [15.171834] [15.171834] 5 bloqueos retenidos por kworker/u8:3/146: [15.171834] #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, en: process_one_work+0x1c3/0x5a0 [15.171834] #1: ffffc9000067be80 ((work_completion)(\u0026amp;fs_info-\u0026gt;async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0 [15.176244] #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs] [15.176244] #3: ffff888102962ee0 (\u0026amp;fs_devs-\u0026gt;device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs] [15.176244] #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs] [15.179641] [15.179641] stack backtrace: [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79 [15.179641] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 01/04/2014 [15.179641] Cola de trabajo: events_unbound btrfs_async_reclaim_data_space [btrfs] [15.179641] Rastreo de llamadas: [15.179641] [15.179641] dump_stack_lvl+0x45/0x59 [15.179641] __lock_acquire.cold+0x217/0x2b2 [15.179641] lock_acquire+0xbf/0x2b0 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] __mutex_lock+0x8e/0x970 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? lock_is_held_type+0xd7/0x130 [15.183838] ? find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] find_free_extent+0x15a/0x14f0 [btrfs] [15.183838] ? _raw_spin_unlock+0x24/0x40 [15.183838] ? btrfs_get_alloc_profile+0x106/0x230 [btrfs] [15.187601] btrfs_reserve_extent+0x131/0x260 [btrfs] [15. ---truncado---"
}
],
"id": "CVE-2022-49079",
"lastModified": "2026-06-17T05:17:01.360",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-26T07:00:45.250",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/09e65ae515af2b24d6dc23af21719a3b41de83e5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/0b9e66762aa0cda2a9c2d5542d64e04dac528fa6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/142f822bd945a7be442a2916ec6167cc102c4183"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-667"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…