CVE-2022-50067

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()<br /> <br /> In btrfs_relocate_block_group(), the rc is allocated. Then<br /> btrfs_relocate_block_group() calls<br /> <br /> relocate_block_group()<br /> prepare_to_relocate()<br /> set_reloc_control()<br /> <br /> that assigns rc to the variable fs_info-&gt;reloc_ctl. When<br /> prepare_to_relocate() returns, it calls<br /> <br /> btrfs_commit_transaction()<br /> btrfs_start_dirty_block_groups()<br /> btrfs_alloc_path()<br /> kmem_cache_zalloc()<br /> <br /> which may fail for example (or other errors could happen). When the<br /> failure occurs, btrfs_relocate_block_group() detects the error and frees<br /> rc and doesn&amp;#39;t set fs_info-&gt;reloc_ctl to NULL. After that, in<br /> btrfs_init_reloc_root(), rc is retrieved from fs_info-&gt;reloc_ctl and<br /> then used, which may cause a use-after-free bug.<br /> <br /> This possible bug can be triggered by calling btrfs_ioctl_balance()<br /> before calling btrfs_ioctl_defrag().<br /> <br /> To fix this possible bug, in prepare_to_relocate(), check if<br /> btrfs_commit_transaction() fails. If the failure occurs,<br /> unset_reloc_control() is called to set fs_info-&gt;reloc_ctl to NULL.<br /> <br /> The error log in our fault-injection testing is shown as follows:<br /> <br /> [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]<br /> ...<br /> [ 58.753577] Call Trace:<br /> ...<br /> [ 58.755800] kasan_report+0x45/0x60<br /> [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs]<br /> [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs]<br /> [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]<br /> [ 58.758231] start_transaction+0x896/0x2950 [btrfs]<br /> [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs]<br /> [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs]<br /> [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs]<br /> ...<br /> [ 58.768510] Allocated by task 23683:<br /> [ 58.768777] ____kasan_kmalloc+0xb5/0xf0<br /> [ 58.769069] __kmalloc+0x227/0x3d0<br /> [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs]<br /> [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]<br /> [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]<br /> [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs]<br /> [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs]<br /> [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]<br /> [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs]<br /> ...<br /> [ 58.773337] Freed by task 23683:<br /> ...<br /> [ 58.774815] kfree+0xda/0x2b0<br /> [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs]<br /> [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]<br /> [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs]<br /> [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs]<br /> [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs]<br /> [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]<br /> [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs]<br /> ...