CVE-2022-48901

一、漏洞信息
 漏洞编号：[CVE-2022-48901](https://nvd.nist.gov/vuln/detail/CVE-2022-48901)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: do not start relocation until in progress drops are doneWe hit a bug with a recovering relocation on mount for one of our filesystems in production.  I reproduced this locally by injecting errorsinto snapshot delete with balance running at the same time.  Thispresented as an error while looking up an extent item  WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680  CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8  RIP: 0010:lookup_inline_extent_backref+0x647/0x680  RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202  RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000  RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000  RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001  R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000  R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000  FS:  0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0  Call Trace:   <TASK>   insert_inline_extent_backref+0x46/0xd0   __btrfs_inc_extent_ref.isra.0+0x5f/0x200   ? btrfs_merge_delayed_refs+0x164/0x190   __btrfs_run_delayed_refs+0x561/0xfa0   ? btrfs_search_slot+0x7b4/0xb30   ? btrfs_update_root+0x1a9/0x2c0   btrfs_run_delayed_refs+0x73/0x1f0   ? btrfs_update_root+0x1a9/0x2c0   btrfs_commit_transaction+0x50/0xa50   ? btrfs_update_reloc_root+0x122/0x220   prepare_to_merge+0x29f/0x320   relocate_block_group+0x2b8/0x550   btrfs_relocate_block_group+0x1a6/0x350   btrfs_relocate_chunk+0x27/0xe0   btrfs_balance+0x777/0xe60   balance_kthread+0x35/0x50   ? btrfs_balance+0xe60/0xe60   kthread+0x16b/0x190   ? set_kthread_struct+0x40/0x40   ret_from_fork+0x22/0x30   </TASK>Normally snapshot deletion and relocation are excluded from running atthe same time by the fs_info->cleaner_mutex.  However if we had apending balance waiting to get the ->cleaner_mutex, and a snapshotdeletion was running, and then the box crashed, we would come up in astate where we have a half deleted snapshot.Again, in the normal case the snapshot deletion needs to complete beforerelocation can start, but in this case relocation could very well startbefore the snapshot deletion completes, as we simply add the root to thedead roots list and wait for the next time the cleaner runs to clean upthe snapshot.Fix this by setting a bit on the fs_info if we have any DEAD_ROOT s thathad a pending drop_progress key.  If they do then we know we were in themiddle of the drop operation and set a flag on the fs_info.  Thenbalance can wait until this flag is cleared to start up again.If there are DEAD_ROOT s that don t have a drop_progress set then we resafe to start balance right away as we ll be properly protected by thecleaner_mutex.
 漏洞公开时间：2024-08-22 10:15:04
 漏洞创建时间：2024-08-22 20:11:52
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48901
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5e70bc827b563caf22e1203428cc3719643de5aa |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6599d5e8bd758d897fd2ef4dc388ae50278b1f7e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48901 | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48901 | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| suse_bugzilla | https://git.kernel.org/stable/c/5e70bc827b563caf22e1203428cc3719643de5aa | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| suse_bugzilla | https://git.kernel.org/stable/c/6599d5e8bd758d897fd2ef4dc388ae50278b1f7e | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| suse_bugzilla | https://git.kernel.org/stable/c/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48901.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229607 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48901 | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://git.kernel.org/linus/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef (5.17-rc7) | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://git.kernel.org/stable/c/6599d5e8bd758d897fd2ef4dc388ae50278b1f7e | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://git.kernel.org/stable/c/5e70bc827b563caf22e1203428cc3719643de5aa | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://git.kernel.org/stable/c/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48901 | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48901 | https://ubuntu.com/security/CVE-2022-48901 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48901 | https://ubuntu.com/security/CVE-2022-48901 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/5e70bc827b563caf22e1203428cc3719643de5aa |  | nvd |
|  |  | https://git.kernel.org/stable/c/6599d5e8bd758d897fd2ef4dc388ae50278b1f7e |  | nvd |
|  |  | https://git.kernel.org/stable/c/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef |  | nvd |
| linux |  | https://git.kernel.org/linus/b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                  In the Linux kernel, the following vulnerability has been resolved:btrfs: do not start relocation until in progress drops are doneWe hit a bug with a recovering relocation on mount for one of our filesystems in production.  I reproduced this locally by injecting errorsinto snapshot delete with balance running at the same time.  Thispresented as an error while looking up an extent item  WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680  CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8  RIP: 0010:lookup_inline_extent_backref+0x647/0x680  RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202  RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000  RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000  RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001  R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000  R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000  FS:  0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0  Call Trace:   <TASK>   insert_inline_extent_backref+0x46/0xd0   __btrfs_inc_extent_ref.isra.0+0x5f/0x200   ? btrfs_merge_delayed_refs+0x164/0x190   __btrfs_run_delayed_refs+0x561/0xfa0   ? btrfs_search_slot+0x7b4/0xb30   ? btrfs_update_root+0x1a9/0x2c0   btrfs_run_delayed_refs+0x73/0x1f0   ? btrfs_update_root+0x1a9/0x2c0   btrfs_commit_transaction+0x50/0xa50   ? btrfs_update_reloc_root+0x122/0x220   prepare_to_merge+0x29f/0x320   relocate_block_group+0x2b8/0x550   btrfs_relocate_block_group+0x1a6/0x350   btrfs_relocate_chunk+0x27/0xe0   btrfs_balance+0x777/0xe60   balance_kthread+0x35/0x50   ? btrfs_balance+0xe60/0xe60   kthread+0x16b/0x190   ? set_kthread_struct+0x40/0x40   ret_from_fork+0x22/0x30   </TASK>Normally snapshot deletion and relocation are excluded from running atthe same time by the fs_info->cleaner_mutex.  However if we had apending balance waiting to get the ->cleaner_mutex, and a snapshotdeletion was running, and then the box crashed, we would come up in astate where we have a half deleted snapshot.Again, in the normal case the snapshot deletion needs to complete beforerelocation can start, but in this case relocation could very well startbefore the snapshot deletion completes, as we simply add the root to thedead roots list and wait for the next time the cleaner runs to clean upthe snapshot.Fix this by setting a bit on the fs_info if we have any DEAD_ROOT s thathad a pending drop_progress key.  If they do then we know we were in themiddle of the drop operation and set a flag on the fs_info.  Thenbalance can wait until this flag is cleared to start up again.If there are DEAD_ROOT s that don t have a drop_progress set then we resafe to start balance right away as we ll be properly protected by thecleaner_mutex.        
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2126

src-openEuler/kernel

Content Risk Flag

Comments (22)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48901

Comments (22)

Search

src-openEuler/kernel