CVE-2022-49547
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix deadlock between concurrent dio writes when low on free data space
When reserving data space for a direct IO write we can end up deadlocking if we have multiple tasks attempting a write to the same file range, there are multiple extents covered by that file range, we are low on available space for data and the writes don't expand the inode's i_size.
The deadlock can happen like this:
This type of deadlock can sporadically be triggered by the test case generic/300 from fstests, and results in a stack trace like the following:
Detalles técnicos trazas, registros y código del informe original
1) We have a file with an i_size of 1M, at offset 0 it has an extent with
a size of 128K and at offset 128K it has another extent also with a
size of 128K;
2) Task A does a direct IO write against file range [0, 256K), and because
the write is within the i_size boundary, it takes the inode's lock (VFS
level) in shared mode;
3) Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and
then gets the extent map for the extent covering the range [0, 128K).
At btrfs_get_blocks_direct_write(), it creates an ordered extent for
that file range ([0, 128K));
4) Before returning from btrfs_dio_iomap_begin(), it unlocks the file
range [0, 256K);
5) Task A executes btrfs_dio_iomap_begin() again, this time for the file
range [128K, 256K), and locks the file range [128K, 256K);
6) Task B starts a direct IO write against file range [0, 256K) as well.
It also locks the inode in shared mode, as it's within the i_size limit,
and then tries to lock file range [0, 256K). It is able to lock the
subrange [0, 128K) but then blocks waiting for the range [128K, 256K),
as it is currently locked by task A;
7) Task A enters btrfs_get_blocks_direct_write() and tries to reserve data
space. Because we are low on available free space, it triggers the
async data reclaim task, and waits for it to reserve data space;
8) The async reclaim task decides to wait for all existing ordered extents
to complete (through btrfs_wait_ordered_roots()).
It finds the ordered extent previously created by task A for the file
range [0, 128K) and waits for it to complete;
9) The ordered extent for the file range [0, 128K) can not complete
because it blocks at btrfs_finish_ordered_io() when trying to lock the
file range [0, 128K).
This results in a deadlock, because:
- task B is holding the file range [0, 128K) locked, waiting for the
range [128K, 256K) to be unlocked by task A;
- task A is holding the file range [128K, 256K) locked and it's waiting
for the async data reclaim task to satisfy its space reservation
request;
- the async data reclaim task is waiting for ordered extent [0, 128K)
to complete, but the ordered extent can not complete because the
file range [0, 128K) is currently locked by task B, which is waiting
on task A to unlock file range [128K, 256K) and task A waiting
on the async data reclaim task.
This results in a deadlock between 4 task: task A, task B, the async
data reclaim task and the task doing ordered extent completion (a work
queue task).
[12084.033689] INFO: task kworker/u16:7:123749 blocked for more than 241 seconds.
[12084.034877] Not tainted 5.18.0-rc2-btrfs-next-115 #1
[12084.035562] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[12084.036548] task:kworker/u16:7 state:D stack: 0 pid:123749 ppid: 2 flags:0x00004000
[12084.036554] Workqueue: btrfs-flush_delalloc btrfs_work_helper [btrfs]
[12084.036599] Call Trace:
[12084.036601] <TASK>
[12084.036606] __schedule+0x3cb/0xed0
[12084.036616] schedule+0x4e/0xb0
[12084.036620] btrfs_start_ordered_extent+0x109/0x1c0 [btrfs]
[12084.036651] ? prepare_to_wait_exclusive+0xc0/0xc0
[12084.036659] btrfs_run_ordered_extent_work+0x1a/0x30 [btrfs]
[12084.036688] btrfs_work_helper+0xf8/0x400 [btrfs]
[12084.0367
---truncated---CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 6
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-667
- CWE-667
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49547",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-49547",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-10-01T19:37:29.090874Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f",
"lessThan": "cfae6f765b3c40882ee90dae8fbf9325c8de9c35",
"versionType": "git"
},
{
"status": "affected",
"version": "f0bfa76a11e93d0fe2c896fcb566568c5e8b5d3f",
"lessThan": "f5585f4f0ef5b17026bbd60fbff6fcc91b99d5bf",
"versionType": "git"
},
{
"status": "affected",
"version": "5afd80c393f4e87451f14eefb7f2f24daf434e06",
"versionType": "git"
},
{
"status": "affected",
"version": "96f1be29492d9e2fb97bb27f824478ab8cd3ab86",
"versionType": "git"
},
{
"status": "affected",
"version": "5.15.27",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.16.13",
"lessThan": "5.17",
"versionType": "semver"
}
],
"programFiles": [
"fs/btrfs/inode.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.18.3",
"versionType": "semver",
"lessThanOrEqual": "5.18.*"
},
{
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/btrfs/inode.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-02-26T07:01:30.590",
"references": [
{
"url": "https://git.kernel.org/stable/c/cfae6f765b3c40882ee90dae8fbf9325c8de9c35",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5585f4f0ef5b17026bbd60fbff6fcc91b99d5bf",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between concurrent dio writes when low on free data space\n\nWhen reserving data space for a direct IO write we can end up deadlocking\nif we have multiple tasks attempting a write to the same file range, there\nare multiple extents covered by that file range, we are low on available\nspace for data and the writes don't expand the inode's i_size.\n\nThe deadlock can happen like this:\n\n1) We have a file with an i_size of 1M, at offset 0 it has an extent with\n a size of 128K and at offset 128K it has another extent also with a\n size of 128K;\n\n2) Task A does a direct IO write against file range [0, 256K), and because\n the write is within the i_size boundary, it takes the inode's lock (VFS\n level) in shared mode;\n\n3) Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and\n then gets the extent map for the extent covering the range [0, 128K).\n At btrfs_get_blocks_direct_write(), it creates an ordered extent for\n that file range ([0, 128K));\n\n4) Before returning from btrfs_dio_iomap_begin(), it unlocks the file\n range [0, 256K);\n\n5) Task A executes btrfs_dio_iomap_begin() again, this time for the file\n range [128K, 256K), and locks the file range [128K, 256K);\n\n6) Task B starts a direct IO write against file range [0, 256K) as well.\n It also locks the inode in shared mode, as it's within the i_size limit,\n and then tries to lock file range [0, 256K). It is able to lock the\n subrange [0, 128K) but then blocks waiting for the range [128K, 256K),\n as it is currently locked by task A;\n\n7) Task A enters btrfs_get_blocks_direct_write() and tries to reserve data\n space. Because we are low on available free space, it triggers the\n async data reclaim task, and waits for it to reserve data space;\n\n8) The async reclaim task decides to wait for all existing ordered extents\n to complete (through btrfs_wait_ordered_roots()).\n It finds the ordered extent previously created by task A for the file\n range [0, 128K) and waits for it to complete;\n\n9) The ordered extent for the file range [0, 128K) can not complete\n because it blocks at btrfs_finish_ordered_io() when trying to lock the\n file range [0, 128K).\n\n This results in a deadlock, because:\n\n - task B is holding the file range [0, 128K) locked, waiting for the\n range [128K, 256K) to be unlocked by task A;\n\n - task A is holding the file range [128K, 256K) locked and it's waiting\n for the async data reclaim task to satisfy its space reservation\n request;\n\n - the async data reclaim task is waiting for ordered extent [0, 128K)\n to complete, but the ordered extent can not complete because the\n file range [0, 128K) is currently locked by task B, which is waiting\n on task A to unlock file range [128K, 256K) and task A waiting\n on the async data reclaim task.\n\n This results in a deadlock between 4 task: task A, task B, the async\n data reclaim task and the task doing ordered extent completion (a work\n queue task).\n\nThis type of deadlock can sporadically be triggered by the test case\ngeneric/300 from fstests, and results in a stack trace like the following:\n\n[12084.033689] INFO: task kworker/u16:7:123749 blocked for more than 241 seconds.\n[12084.034877] Not tainted 5.18.0-rc2-btrfs-next-115 #1\n[12084.035562] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[12084.036548] task:kworker/u16:7 state:D stack: 0 pid:123749 ppid: 2 flags:0x00004000\n[12084.036554] Workqueue: btrfs-flush_delalloc btrfs_work_helper [btrfs]\n[12084.036599] Call Trace:\n[12084.036601] <TASK>\n[12084.036606] __schedule+0x3cb/0xed0\n[12084.036616] schedule+0x4e/0xb0\n[12084.036620] btrfs_start_ordered_extent+0x109/0x1c0 [btrfs]\n[12084.036651] ? prepare_to_wait_exclusive+0xc0/0xc0\n[12084.036659] btrfs_run_ordered_extent_work+0x1a/0x30 [btrfs]\n[12084.036688] btrfs_work_helper+0xf8/0x400 [btrfs]\n[12084.0367\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: arregla el bloqueo entre escrituras dio concurrentes cuando hay poco espacio libre en los datos Al reservar espacio de datos para una escritura IO directa podemos acabar en un bloqueo si tenemos varias tareas intentando escribir en el mismo rango de archivos, hay varias extensiones cubiertas por ese rango de archivos, tenemos poco espacio disponible para los datos y las escrituras no expanden el i_size del inodo. El bloqueo puede ocurrir así: 1) Tenemos un archivo con un i_size de 1M, en el desplazamiento 0 tiene una extensión con un tamaño de 128K y en el desplazamiento 128K tiene otra extensión también con un tamaño de 128K; 2) La tarea A realiza una escritura IO directa contra el rango de archivos [0, 256K), y debido a que la escritura está dentro del límite i_size, toma el bloqueo del inodo (nivel VFS) en modo compartido; 3) La tarea A bloquea el rango de archivos [0, 256K) en btrfs_dio_iomap_begin() y luego obtiene el mapa de extensión para la extensión que cubre el rango [0, 128K). En btrfs_get_blocks_direct_write(), crea una extensión ordenada para ese rango de archivos ([0, 128K)); 4) Antes de regresar de btrfs_dio_iomap_begin(), desbloquea el rango de archivos [0, 256K); 5) La tarea A ejecuta btrfs_dio_iomap_begin() nuevamente, esta vez para el rango de archivos [128K, 256K), y bloquea el rango de archivos [128K, 256K); 6) La tarea B también inicia una escritura de E/S directa contra el rango de archivos [0, 256K). También bloquea el inodo en modo compartido, ya que está dentro del límite i_size, y luego intenta bloquear el rango de archivos [0, 256K). Puede bloquear el subrango [0, 128K) pero luego bloquea la espera del rango [128K, 256K), ya que está bloqueado actualmente por la tarea A; 7) La tarea A ingresa a btrfs_get_blocks_direct_write() e intenta reservar espacio de datos. Debido a que tenemos poco espacio libre disponible, activa la tarea de recuperación de datos asíncrona y espera a que reserve espacio de datos; 8) La tarea de recuperación asíncrona decide esperar a que se completen todas las extensiones ordenadas existentes (a través de btrfs_wait_ordered_roots()). Encuentra la extensión ordenada creada previamente por la tarea A para el rango de archivos [0, 128K) y espera a que se complete; 9) La extensión ordenada para el rango de archivos [0, 128K) no se puede completar porque se bloquea en btrfs_finish_ordered_io() cuando intenta bloquear el rango de archivos [0, 128K). Esto da como resultado un punto muerto, porque: - la tarea B mantiene bloqueado el rango de archivos [0, 128K), esperando que la tarea A desbloquee el rango [128K, 256K); - la tarea A mantiene bloqueado el rango de archivos [128K, 256K) y está esperando que la tarea de recuperación de datos asíncrona satisfaga su solicitud de reserva de espacio; - la tarea de recuperación de datos asíncrona está esperando que se complete la extensión ordenada [0, 128K), pero la extensión ordenada no se puede completar porque el rango de archivos [0, 128K) está bloqueado actualmente por la tarea B, que está esperando que la tarea A desbloquee el rango de archivos [128K, 256K) y la tarea A está esperando la tarea de recuperación de datos asíncrona. Esto da como resultado un bloqueo entre 4 tareas: la tarea A, la tarea B, la tarea de recuperación de datos asincrónica y la tarea que realiza la finalización de la extensión ordenada (una tarea de cola de trabajo). Este tipo de bloqueo puede ser activado esporádicamente por el caso de prueba generic/300 de fstests y da como resultado un seguimiento de pila como el siguiente: [12084.033689] INFO: la tarea kworker/u16:7:123749 se bloqueó durante más de 241 segundos. [12084.033689] INFO: task kworker/u16:7:123749 blocked for more than 241 seconds. [12084.034877] Not tainted 5.18.0-rc2-btrfs-next-115 #1 [12084.035562] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. [12084.036548] task:kworker/u16:7 state:D stack: 0 pid:123749 ppid: 2 flags:---truncated--- "
}
],
"lastModified": "2026-06-17T05:18:24.597",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "682E95CF-F3D0-4417-B632-F8B6EE54D517",
"versionEndExcluding": "5.16",
"versionStartIncluding": "5.15.27"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21CCFEA4-A572-4BBD-ACCC-76ADE4CDCBF9",
"versionEndExcluding": "5.18.3",
"versionStartIncluding": "5.16.13"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}