CVE-2022-49075

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix qgroup reserve overflow the qgroup limit<br /> <br /> We use extent_changeset-&gt;bytes_changed in qgroup_reserve_data() to record<br /> how many bytes we set for EXTENT_QGROUP_RESERVED state. Currently the<br /> bytes_changed is set as "unsigned int", and it will overflow if we try to<br /> fallocate a range larger than 4GiB. The result is we reserve less bytes<br /> and eventually break the qgroup limit.<br /> <br /> Unlike regular buffered/direct write, which we use one changeset for<br /> each ordered extent, which can never be larger than 256M. For<br /> fallocate, we use one changeset for the whole range, thus it no longer<br /> respects the 256M per extent limit, and caused the problem.<br /> <br /> The following example test script reproduces the problem:<br /> <br /> $ cat qgroup-overflow.sh<br /> #!/bin/bash<br /> <br /> DEV=/dev/sdj<br /> MNT=/mnt/sdj<br /> <br /> mkfs.btrfs -f $DEV<br /> mount $DEV $MNT<br /> <br /> # Set qgroup limit to 2GiB.<br /> btrfs quota enable $MNT<br /> btrfs qgroup limit 2G $MNT<br /> <br /> # Try to fallocate a 3GiB file. This should fail.<br /> echo<br /> echo "Try to fallocate a 3GiB file..."<br /> fallocate -l 3G $MNT/3G.file<br /> <br /> # Try to fallocate a 5GiB file.<br /> echo<br /> echo "Try to fallocate a 5GiB file..."<br /> fallocate -l 5G $MNT/5G.file<br /> <br /> # See we break the qgroup limit.<br /> echo<br /> sync<br /> btrfs qgroup show -r $MNT<br /> <br /> umount $MNT<br /> <br /> When running the test:<br /> <br /> $ ./qgroup-overflow.sh<br /> (...)<br /> <br /> Try to fallocate a 3GiB file...<br /> fallocate: fallocate failed: Disk quota exceeded<br /> <br /> Try to fallocate a 5GiB file...<br /> <br /> qgroupid         rfer         excl     max_rfer<br /> --------         ----         ----     --------<br /> 0/5           5.00GiB      5.00GiB      2.00GiB<br /> <br /> Since we have no control of how bytes_changed is used, it&amp;#39;s better to<br /> set it to u64.