Message-ID: <2025050143-CVE-2022-49850-6ed9@gregkh>
Date: Thu,  1 May 2025 16:10:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49850: nilfs2: fix deadlock in nilfs_count_free_blocks()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix deadlock in nilfs_count_free_blocks()

A semaphore deadlock can occur if nilfs_get_block() detects metadata
corruption while locating data blocks and a superblock writeback occurs at
the same time:

task 1                               task 2
------                               ------
* A file operation *
nilfs_truncate()
  nilfs_get_block()
    down_read(rwsem A) <--
    nilfs_bmap_lookup_contig()
      ...                            generic_shutdown_super()
                                       nilfs_put_super()
                                         * Prepare to write superblock *
                                         down_write(rwsem B) <--
                                         nilfs_cleanup_super()
      * Detect b-tree corruption *         nilfs_set_log_cursor()
      nilfs_bmap_convert_error()             nilfs_count_free_blocks()
        __nilfs_error()                        down_read(rwsem A) <--
          nilfs_set_error()
            down_write(rwsem B) <--

                           *** DEADLOCK ***

Here, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)->mi_sem)
and then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata
corruption, __nilfs_error() is called from nilfs_bmap_convert_error()
inside the lock section.

Since __nilfs_error() calls nilfs_set_error() unless the filesystem is
read-only and nilfs_set_error() attempts to writelock rwsem B (=
nilfs->ns_sem) to write back superblock exclusively, hierarchical lock
acquisition occurs in the order rwsem A -> rwsem B.

Now, if another task starts updating the superblock, it may writelock
rwsem B during the lock sequence above, and can deadlock trying to
readlock rwsem A in nilfs_count_free_blocks().

However, there is actually no need to take rwsem A in
nilfs_count_free_blocks() because it, within the lock section, only reads
a single integer data on a shared struct with
nilfs_sufile_get_ncleansegs().  This has been the case after commit
aa474a220180 ("nilfs2: add local variable to cache the number of clean
segments"), that is, even before this bug was introduced.

So, this resolves the deadlock problem by just not taking the semaphore in
nilfs_count_free_blocks().

The Linux kernel CVE team has assigned CVE-2022-49850 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 4.9.334 with commit 3c89ca6d3dfa6c09c515807a7a97a521f5d5147e
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 4.14.300 with commit 8b4506cff6630bb474bb46a2a75c31e533a756ba
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 4.19.267 with commit f0cc93080d4c09510b74ecba87fd778cca390bb1
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 5.4.225 with commit 36ff974b0310771417c0be64b64aa221bd70d63d
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 5.10.155 with commit 1d4ff73062096c21b47954d2996b4df259777bda
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 5.15.79 with commit abc082aac0d9b6b926038fc3adb7008306581be2
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 6.0.9 with commit cb029b54953420f7a2d65100f1c5107f14411bdc
	Issue introduced in 2.6.38 with commit e828949e5b42bfd234ee537cdb7c5e3a577958a3 and fixed in 6.1 with commit 8ac932a4921a96ca52f61935dbba64ea87bbd5dc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49850
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nilfs2/the_nilfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3c89ca6d3dfa6c09c515807a7a97a521f5d5147e
	https://git.kernel.org/stable/c/8b4506cff6630bb474bb46a2a75c31e533a756ba
	https://git.kernel.org/stable/c/f0cc93080d4c09510b74ecba87fd778cca390bb1
	https://git.kernel.org/stable/c/36ff974b0310771417c0be64b64aa221bd70d63d
	https://git.kernel.org/stable/c/1d4ff73062096c21b47954d2996b4df259777bda
	https://git.kernel.org/stable/c/abc082aac0d9b6b926038fc3adb7008306581be2
	https://git.kernel.org/stable/c/cb029b54953420f7a2d65100f1c5107f14411bdc
	https://git.kernel.org/stable/c/8ac932a4921a96ca52f61935dbba64ea87bbd5dc

Powered by blists - more mailing lists