English version →
カテゴリ
CVE-2022-49547

btrfs: fix deadlock between concurrent dio writes when low on free data space

概要

btrfs: fix deadlock between concurrent dio writes when low on free data space

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock between concurrent dio writes when low on free data space

When reserving data space for a direct IO write we can end up deadlocking
if we have multiple tasks attempting a write to the same file range, there
are multiple extents covered by that file range, we are low on available
space for data and the writes don't expand the inode's i_size.

The deadlock can happen like this:

  1. We have a file with an i_size of 1M, at offset 0 it has an extent with
    a size of 128K and at offset 128K it has another extent also with a
    size of 128K;

  2. Task A does a direct IO write against file range [0, 256K), and because
    the write is within the i_size boundary, it takes the inode's lock (VFS
    level) in shared mode;

  3. Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and
    then gets the extent map for the extent covering the range [0, 128K).
    At btrfs_get_blocks_direct_write(), it creates an ordered extent for
    that file range ([0, 128K));

  4. Before returning from btrfs_dio_iomap_begin(), it unlocks the file
    range [0, 256K);

  5. Task A executes btrfs_dio_iomap_begin() again, this time for the file
    range [128K, 256K), and locks the file range [128K, 256K);

  6. Task B starts a direct IO write against file range [0, 256K) as well.
    It also locks the inode in shared mode, as it's within the i_size limit,
    and then tries to lock file range [0, 256K). It is able to l…

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Linux Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"5.18.3"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

参照URL

当サイトでは、アクセス解析と広告の効果測定のために Cookie を使います。株式会社Game のサイト共通の設定です。 詳しく