UBUNTU-CVE-2022-49033
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update_qgroup_limit_item+0xe1/0x390 btrfs_qgroup_inherit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_ioctl_snap_create_v2+0x25a/0x520 btrfs_ioctl+0x2a1c/0x5ce0 __x64_sys_ioctl+0x193/0x200 do_syscall_64+0x35/0x80 Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in btrfs_run_qgroups() later outside of the spinlock context.
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
10 explicit affected versions
16 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
25 explicit affected versions
11 explicit affected versions
33 explicit affected versions
22 explicit affected versions
11 explicit affected versions
10 explicit affected versions
17 explicit affected versions
7 explicit affected versions
96 explicit affected versions
19 explicit affected versions
59 explicit affected versions
75 explicit affected versions
13 explicit affected versions
46 explicit affected versions
35 explicit affected versions
18 explicit affected versions
109 explicit affected versions
6 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
118 explicit affected versions
1 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
17 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
12 explicit affected versions
64 explicit affected versions
23 explicit affected versions
72 explicit affected versions
12 explicit affected versions
61 explicit affected versions
117 explicit affected versions
50 explicit affected versions
10 explicit affected versions
185 explicit affected versions
37 explicit affected versions
13 explicit affected versions
10 explicit affected versions
1 explicit affected versions
1 explicit affected versions
8 explicit affected versions
26 explicit affected versions
13 explicit affected versions
1 explicit affected versions
29 explicit affected versions
13 explicit affected versions
89 explicit affected versions
22 explicit affected versions
1 explicit affected versions
21 explicit affected versions
64 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
73 explicit affected versions
11 explicit affected versions
12 explicit affected versions
96 explicit affected versions
7 explicit affected versions
12 explicit affected versions
62 explicit affected versions
2 explicit affected versions
11 explicit affected versions
6 explicit affected versions
19 explicit affected versions
162 explicit affected versions
61 explicit affected versions
10 explicit affected versions
26 explicit affected versions
2 explicit affected versions
13 explicit affected versions
16 explicit affected versions
22 explicit affected versions
12 explicit affected versions
3 explicit affected versions
1 explicit affected versions
30 explicit affected versions
51 explicit affected versions
50 explicit affected versions
12 explicit affected versions
11 explicit affected versions
27 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
55 explicit affected versions
8 explicit affected versions
5 explicit affected versions
53 explicit affected versions
8 explicit affected versions
1 explicit affected versions
52 explicit affected versions
10 explicit affected versions
13 explicit affected versions
13 explicit affected versions
18 explicit affected versions
7 explicit affected versions
51 explicit affected versions
14 explicit affected versions
10 explicit affected versions
3 explicit affected versions
12 explicit affected versions
48 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
8 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
12 explicit affected versions
9 explicit affected versions
12 explicit affected versions
11 explicit affected versions
20 explicit affected versions
52 explicit affected versions
7 explicit affected versions
94 explicit affected versions
27 explicit affected versions
101 explicit affected versions
80 explicit affected versions
4 explicit affected versions
17 explicit affected versions
72 explicit affected versions
13 explicit affected versions
51 explicit affected versions
43 explicit affected versions
18 explicit affected versions
141 explicit affected versions
123 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
52 explicit affected versions
4 explicit affected versions
41 explicit affected versions
11 explicit affected versions
1 explicit affected versions
27 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update_qgroup_limit_item+0xe1/0x390 btrfs_qgroup_inherit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_ioctl_snap_create_v2+0x25a/0x520 btrfs_ioctl+0x2a1c/0x5ce0 __x64_sys_ioctl+0x193/0x200 do_syscall_64+0x35/0x80 Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in btrfs_run_qgroups() later outside of the spinlock context.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/f7e942b5bb35d8e3af54053d19a6bf04143a3955
- https://git.kernel.org/stable/c/01d7c41eac9129fba80d8aed0060caab4a7dbe09
- https://git.kernel.org/stable/c/044da1a371a0da579e805e89c96865f62d8f6f69
- https://git.kernel.org/stable/c/3c98e91be6aea4c7acf09da6eb0c107ea9186bb5
- https://git.kernel.org/stable/c/588ae4fdd8b11788a797776b10d6c44ae12bc133
- https://git.kernel.org/stable/c/89840b12c8fad7200eb6478525c13261512c01be
- https://git.kernel.org/stable/c/8eb912af525042a7365295eb62f6d5270c2a6462
- https://git.kernel.org/stable/c/f4b930a1602b05e77fee31f9616599b25e910a86
- https://git.kernel.org/stable/c/f7e942b5bb35d8e3af54053d19a6bf04143a3955
- https://ubuntu.com/security/CVE-2022-49033
- https://ubuntu.com/security/notices/USN-8274-1
- https://www.cve.org/CVERecord?id=CVE-2022-49033