In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not clean up repair bio if submit fails
The submit helper will always run bioendio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLKSTS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14",
"deprecated": false,
"id": "CVE-2022-49168-2238516b",
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"21873192601594725603811221106929092478",
"267629818792585249038084958498617672123",
"180458818990655430879463807857198476790",
"163853238954495424581778383038353150666",
"122817579105577032533190069477275505286",
"128879599812595668055159118637175694947",
"102435202302242138621760338417186561286",
"209814709082447454749268966906657508390",
"108480596017370257999104508531867238706",
"130837265386790497876232117470055530881",
"176245472441424289278930629274229804838",
"236112554330614302257870894351276477926",
"246382918480010219668840844215582093441",
"323548858104619969686780706777552432285"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c78c48902dae6fa612749f59162bca0a79e0b",
"deprecated": false,
"id": "CVE-2022-49168-3169e2fd",
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"21873192601594725603811221106929092478",
"267629818792585249038084958498617672123",
"180458818990655430879463807857198476790",
"163853238954495424581778383038353150666",
"122817579105577032533190069477275505286",
"128879599812595668055159118637175694947",
"102435202302242138621760338417186561286",
"209814709082447454749268966906657508390",
"108480596017370257999104508531867238706",
"130837265386790497876232117470055530881",
"176245472441424289278930629274229804838",
"236112554330614302257870894351276477926",
"246382918480010219668840844215582093441",
"323548858104619969686780706777552432285"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7170875083254b51fcc5d67f96640977083f481e",
"deprecated": false,
"id": "CVE-2022-49168-369b74ef",
"target": {
"function": "btrfs_repair_one_sector",
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"function_hash": "274504110067424119331453865745534134737",
"length": 1489.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14",
"deprecated": false,
"id": "CVE-2022-49168-49aff055",
"target": {
"function": "btrfs_repair_one_sector",
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"function_hash": "30098999840600615596760887437051837131",
"length": 1457.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7170875083254b51fcc5d67f96640977083f481e",
"deprecated": false,
"id": "CVE-2022-49168-53ee96d8",
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"292221503676637616010401189363823380823",
"246962027593917898824861869301662413567",
"236683917825931540046837909212540551901",
"163853238954495424581778383038353150666",
"122817579105577032533190069477275505286",
"128879599812595668055159118637175694947",
"102435202302242138621760338417186561286",
"209814709082447454749268966906657508390",
"108480596017370257999104508531867238706",
"130837265386790497876232117470055530881",
"176245472441424289278930629274229804838",
"236112554330614302257870894351276477926",
"246382918480010219668840844215582093441",
"323548858104619969686780706777552432285"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cbc3001a3264d998d6b6db3e23f935c158abd4d",
"deprecated": false,
"id": "CVE-2022-49168-8dc9eb0b",
"target": {
"function": "btrfs_repair_one_sector",
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"function_hash": "30098999840600615596760887437051837131",
"length": 1457.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c78c48902dae6fa612749f59162bca0a79e0b",
"deprecated": false,
"id": "CVE-2022-49168-f56fa043",
"target": {
"function": "btrfs_repair_one_sector",
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"function_hash": "30098999840600615596760887437051837131",
"length": 1457.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cbc3001a3264d998d6b6db3e23f935c158abd4d",
"deprecated": false,
"id": "CVE-2022-49168-fb5f3915",
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"21873192601594725603811221106929092478",
"267629818792585249038084958498617672123",
"180458818990655430879463807857198476790",
"163853238954495424581778383038353150666",
"122817579105577032533190069477275505286",
"128879599812595668055159118637175694947",
"102435202302242138621760338417186561286",
"209814709082447454749268966906657508390",
"108480596017370257999104508531867238706",
"130837265386790497876232117470055530881",
"176245472441424289278930629274229804838",
"236112554330614302257870894351276477926",
"246382918480010219668840844215582093441",
"323548858104619969686780706777552432285"
]
},
"signature_type": "Line"
}
]