CVE-2022-49761

btrfs: always report error in run_one_delayed_ref()

High · published March 27, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: always report error in run_one_delayed_ref()

Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but

if end users hit such problem, there will be no chance that

btrfs_debug() is enabled. This can lead to very little useful info for

debugging.

This patch will:

- Add extra info for error reporting

Including:

* logical bytenr

* num_bytes

* type

* action

* ref_mod

- Replace the btrfs_debug() with btrfs_err()

- Move the error reporting into run_one_delayed_ref()

This is to avoid use-after-free, the @node can be freed in the caller.

This error should only be triggered at most once.

As if run_one_delayed_ref() failed, we trigger the error message, then

causing the call chain to error out:

btrfs_run_delayed_refs()

`- btrfs_run_delayed_refs()

`- btrfs_run_delayed_refs_for_head()

`- run_one_delayed_ref()

And we will abort the current transaction in btrfs_run_delayed_refs().

If we have to run delayed refs for the abort transaction,

run_one_delayed_ref() will just cleanup the refs and do nothing, thus no

new error messages would be output.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.1th percentile
Published
2025-03-27T16:43Z
EPSS history
Timeline
  • 27 MAR 16:43Z
    btrfs: always report error in run_one_delayed_ref()
    cvelistv5