In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix sleep from invalid context bug in btrfsqgroupinherit()
Syzkaller reported BUG as follows:
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: <TASK> dumpstacklvl+0xcd/0x134 _mightresched.cold+0x222/0x26b kmemcachealloc+0x2e7/0x3c0 updateqgrouplimititem+0xe1/0x390 btrfsqgroupinherit+0x147b/0x1ee0 createsubvol+0x4eb/0x1710 btrfsmksubvol+0xfe5/0x13f0 _btrfsioctlsnapcreate+0x2b0/0x430 btrfsioctlsnapcreatev2+0x25a/0x520 btrfsioctl+0x2a1c/0x5ce0 _x64sysioctl+0x193/0x200 dosyscall_64+0x35/0x80
Fix this by calling qgroupdirty() on @dstqgroup, and update limit item in btrfsrun_qgroups() later outside of the spinlock context.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "333117017068590746400093314649237036037",
"length": 3621.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-06fd11ea",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@044da1a371a0da579e805e89c96865f62d8f6f69"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "72295860103292717723817993479051552798",
"length": 3539.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-30d05582",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89840b12c8fad7200eb6478525c13261512c01be"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "333117017068590746400093314649237036037",
"length": 3621.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-3206cf60",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@588ae4fdd8b11788a797776b10d6c44ae12bc133"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"328067729730982742285559784844717951883",
"323103178069410626358840245038879755767",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-4c88d376",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8eb912af525042a7365295eb62f6d5270c2a6462"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"328067729730982742285559784844717951883",
"323103178069410626358840245038879755767",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-69497dab",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@044da1a371a0da579e805e89c96865f62d8f6f69"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"39650638145361083268203489799901860599",
"176984113078215469801747632656686067342",
"301672430755922100772308331548850923892",
"15297312568158267909028292807280824612",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-6ccecda2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c98e91be6aea4c7acf09da6eb0c107ea9186bb5"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "181658761114702612820834663241790397155",
"length": 3577.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-6da52fd3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8eb912af525042a7365295eb62f6d5270c2a6462"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "333117017068590746400093314649237036037",
"length": 3621.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-71310684",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01d7c41eac9129fba80d8aed0060caab4a7dbe09"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"165207935987453018205456255154031443538",
"222656771109887086331026123471535899025",
"194410607846773273368281161373958125033",
"179809127987528750976502533174354778190",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-82d3ba4d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7e942b5bb35d8e3af54053d19a6bf04143a3955"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "204351891024929129626700639853727433772",
"length": 3533.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-aa8f0904",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7e942b5bb35d8e3af54053d19a6bf04143a3955"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"328067729730982742285559784844717951883",
"323103178069410626358840245038879755767",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-c096004a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01d7c41eac9129fba80d8aed0060caab4a7dbe09"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"328067729730982742285559784844717951883",
"323103178069410626358840245038879755767",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-dac4c3d1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@588ae4fdd8b11788a797776b10d6c44ae12bc133"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42560766769222967927636197705234239252",
"177371901791041220825727202430203437681",
"328067729730982742285559784844717951883",
"323103178069410626358840245038879755767",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-e74bc046",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b930a1602b05e77fee31f9616599b25e910a86"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "181658761114702612820834663241790397155",
"length": 3577.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-e8edd9ca",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b930a1602b05e77fee31f9616599b25e910a86"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "276708082518573557952558988326457115732",
"length": 3504.0
},
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_inherit"
},
"signature_version": "v1",
"id": "CVE-2022-49033-e92da70c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c98e91be6aea4c7acf09da6eb0c107ea9186bb5"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"39650638145361083268203489799901860599",
"176984113078215469801747632656686067342",
"301672430755922100772308331548850923892",
"15297312568158267909028292807280824612",
"244011282363872694471657621565737107160",
"151294129647865694936373664805804961318",
"3948034884563097277533672099165405433",
"338704604621423847128353898462878046832",
"232917226396298629884792575711844238304",
"183543276050779464593911985971887223320",
"236840466151481971227563615006335724081"
]
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"signature_version": "v1",
"id": "CVE-2022-49033-ec3f5f3a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89840b12c8fad7200eb6478525c13261512c01be"
}
]