btrfs: fix deadlock between concurrent dio writes when low on free data space
概要
btrfs: fix deadlock between concurrent dio writes when low on free data space
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix deadlock between concurrent dio writes when low on free data space
When reserving data space for a direct IO write we can end up deadlocking
if we have multiple tasks attempting a write to the same file range, there
are multiple extents covered by that file range, we are low on available
space for data and the writes don't expand the inode's i_size.
The deadlock can happen like this:
-
We have a file with an i_size of 1M, at offset 0 it has an extent with
a size of 128K and at offset 128K it has another extent also with a
size of 128K; -
Task A does a direct IO write against file range [0, 256K), and because
the write is within the i_size boundary, it takes the inode's lock (VFS
level) in shared mode; -
Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and
then gets the extent map for the extent covering the range [0, 128K).
At btrfs_get_blocks_direct_write(), it creates an ordered extent for
that file range ([0, 128K)); -
Before returning from btrfs_dio_iomap_begin(), it unlocks the file
range [0, 256K); -
Task A executes btrfs_dio_iomap_begin() again, this time for the file
range [128K, 256K), and locks the file range [128K, 256K); -
Task B starts a direct IO write against file range [0, 256K) as well.
It also locks the inode in shared mode, as it's within the i_size limit,
and then tries to lock file range [0, 256K). It is able to l…
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-49547 linux 修正版: 5.18.5-1
- Ubuntu UBUNTU-CVE-2022-49547 linux-hwe-edge
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org