CVE-2022-48833

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: skip reserved bytes warning on unmount after log cleanup failure

After the recent changes made by commit c2e39305299f01 ("btrfs: clear

extent buffer uptodate when we fail to write it") and its followup fix,

commit 651740a5024117 ("btrfs: check WRITE_ERR when trying to read an

extent buffer"), we can now end up not cleaning up space reservations of

log tree extent buffers after a transaction abort happens, as well as not

cleaning up still dirty extent buffers.

This happens because if writeback for a log tree extent buffer failed,

then we have cleared the bit EXTENT_BUFFER_UPTODATE from the extent buffer

and we have also set the bit EXTENT_BUFFER_WRITE_ERR on it. Later on,

when trying to free the log tree with free_log_tree(), which iterates

over the tree, we can end up getting an -EIO error when trying to read

a node or a leaf, since read_extent_buffer_pages() returns -EIO if an

extent buffer does not have EXT

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References