Vulnerability-Lookup

GHSA-785M-WWRQ-6238

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-18 03:31

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: ensure pages are unlocked on cow_file_range() failure

There is a hung_task report on zoned btrfs like below.

https://github.com/naota/linux/issues/59

[726.328648] INFO: task rocksdb:high0:11085 blocked for more than 241 seconds. [726.329839] Not tainted 5.16.0-rc1+ #1 [726.330484] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [726.331603] task:rocksdb:high0 state:D stack: 0 pid:11085 ppid: 11082 flags:0x00000000 [726.331608] Call Trace: [726.331611] [726.331614] __schedule+0x2e5/0x9d0 [726.331622] schedule+0x58/0xd0 [726.331626] io_schedule+0x3f/0x70 [726.331629] __folio_lock+0x125/0x200 [726.331634] ? find_get_entries+0x1bc/0x240 [726.331638] ? filemap_invalidate_unlock_two+0x40/0x40 [726.331642] truncate_inode_pages_range+0x5b2/0x770 [726.331649] truncate_inode_pages_final+0x44/0x50 [726.331653] btrfs_evict_inode+0x67/0x480 [726.331658] evict+0xd0/0x180 [726.331661] iput+0x13f/0x200 [726.331664] do_unlinkat+0x1c0/0x2b0 [726.331668] __x64_sys_unlink+0x23/0x30 [726.331670] do_syscall_64+0x3b/0xc0 [726.331674] entry_SYSCALL_64_after_hwframe+0x44/0xae [726.331677] RIP: 0033:0x7fb9490a171b [726.331681] RSP: 002b:00007fb943ffac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [726.331684] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9490a171b [726.331686] RDX: 00007fb943ffb040 RSI: 000055a6bbe6ec20 RDI: 00007fb94400d300 [726.331687] RBP: 00007fb943ffad00 R08: 0000000000000000 R09: 0000000000000000 [726.331688] R10: 0000000000000031 R11: 0000000000000246 R12: 00007fb943ffb000 [726.331690] R13: 00007fb943ffb040 R14: 0000000000000000 R15: 00007fb943ffd260 [726.331693]

While we debug the issue, we found running fstests generic/551 on 5GB non-zoned null_blk device in the emulated zoned mode also had a similar hung issue.

Also, we can reproduce the same symptom with an error injected cow_file_range() setup.

The hang occurs when cow_file_range() fails in the middle of allocation. cow_file_range() called from do_allocation_zoned() can split the give region ([start, end]) for allocation depending on current block group usages. When btrfs can allocate bytes for one part of the split regions but fails for the other region (e.g. because of -ENOSPC), we return the error leaving the pages in the succeeded regions locked. Technically, this occurs only when @unlock == 0. Otherwise, we unlock the pages in an allocated region after creating an ordered extent.

Considering the callers of cow_file_range(unlock=0) won't write out the pages, we can unlock the pages on error exit from cow_file_range(). So, we can ensure all the pages except @locked_page are unlocked on error case.

In summary, cow_file_range now behaves like this:

page_started == 1 (return value)
All the pages are unlocked. IO is started.
unlock == 1
All the pages except @locked_page are unlocked in any case
unlock == 0
On success, all the pages are locked for writing out them
On failure, all the pages except @locked_page are unlocked

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50089"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:38Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: ensure pages are unlocked on cow_file_range() failure\n\nThere is a hung_task report on zoned btrfs like below.\n\nhttps://github.com/naota/linux/issues/59\n\n  [726.328648] INFO: task rocksdb:high0:11085 blocked for more than 241 seconds.\n  [726.329839]       Not tainted 5.16.0-rc1+ #1\n  [726.330484] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [726.331603] task:rocksdb:high0   state:D stack:    0 pid:11085 ppid: 11082 flags:0x00000000\n  [726.331608] Call Trace:\n  [726.331611]  \u003cTASK\u003e\n  [726.331614]  __schedule+0x2e5/0x9d0\n  [726.331622]  schedule+0x58/0xd0\n  [726.331626]  io_schedule+0x3f/0x70\n  [726.331629]  __folio_lock+0x125/0x200\n  [726.331634]  ? find_get_entries+0x1bc/0x240\n  [726.331638]  ? filemap_invalidate_unlock_two+0x40/0x40\n  [726.331642]  truncate_inode_pages_range+0x5b2/0x770\n  [726.331649]  truncate_inode_pages_final+0x44/0x50\n  [726.331653]  btrfs_evict_inode+0x67/0x480\n  [726.331658]  evict+0xd0/0x180\n  [726.331661]  iput+0x13f/0x200\n  [726.331664]  do_unlinkat+0x1c0/0x2b0\n  [726.331668]  __x64_sys_unlink+0x23/0x30\n  [726.331670]  do_syscall_64+0x3b/0xc0\n  [726.331674]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n  [726.331677] RIP: 0033:0x7fb9490a171b\n  [726.331681] RSP: 002b:00007fb943ffac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000057\n  [726.331684] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9490a171b\n  [726.331686] RDX: 00007fb943ffb040 RSI: 000055a6bbe6ec20 RDI: 00007fb94400d300\n  [726.331687] RBP: 00007fb943ffad00 R08: 0000000000000000 R09: 0000000000000000\n  [726.331688] R10: 0000000000000031 R11: 0000000000000246 R12: 00007fb943ffb000\n  [726.331690] R13: 00007fb943ffb040 R14: 0000000000000000 R15: 00007fb943ffd260\n  [726.331693]  \u003c/TASK\u003e\n\nWhile we debug the issue, we found running fstests generic/551 on 5GB\nnon-zoned null_blk device in the emulated zoned mode also had a\nsimilar hung issue.\n\nAlso, we can reproduce the same symptom with an error injected\ncow_file_range() setup.\n\nThe hang occurs when cow_file_range() fails in the middle of\nallocation. cow_file_range() called from do_allocation_zoned() can\nsplit the give region ([start, end]) for allocation depending on\ncurrent block group usages. When btrfs can allocate bytes for one part\nof the split regions but fails for the other region (e.g. because of\n-ENOSPC), we return the error leaving the pages in the succeeded regions\nlocked. Technically, this occurs only when @unlock == 0. Otherwise, we\nunlock the pages in an allocated region after creating an ordered\nextent.\n\nConsidering the callers of cow_file_range(unlock=0) won\u0027t write out\nthe pages, we can unlock the pages on error exit from\ncow_file_range(). So, we can ensure all the pages except @locked_page\nare unlocked on error case.\n\nIn summary, cow_file_range now behaves like this:\n\n- page_started == 1 (return value)\n  - All the pages are unlocked. IO is started.\n- unlock == 1\n  - All the pages except @locked_page are unlocked in any case\n- unlock == 0\n  - On success, all the pages are locked for writing out them\n  - On failure, all the pages except @locked_page are unlocked",
  "id": "GHSA-785m-wwrq-6238",
  "modified": "2025-11-18T03:31:13Z",
  "published": "2025-06-18T12:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50089"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9535ec371d741fa037e37eddc0a5b25ba82d0027"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ce7466f372d83054c7494f6b3e4b9abaf3f0355"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b367f125c80fa838eae49e3b138dc67dfc9f46ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e160aa87c87a9c4e0c8d1430235f715a3a91e2cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-50089 (GCVE-0-2022-50089)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-05-11 19:12

Title

btrfs: ensure pages are unlocked on cow_file_range() failure

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure pages are unlocked on cow_file_range() failure There is a hung_task report on zoned btrfs like below. https://github.com/naota/linux/issues/59 [726.328648] INFO: task rocksdb:high0:11085 blocked for more than 241 seconds. [726.329839] Not tainted 5.16.0-rc1+ #1 [726.330484] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [726.331603] task:rocksdb:high0 state:D stack: 0 pid:11085 ppid: 11082 flags:0x00000000 [726.331608] Call Trace: [726.331611] <TASK> [726.331614] __schedule+0x2e5/0x9d0 [726.331622] schedule+0x58/0xd0 [726.331626] io_schedule+0x3f/0x70 [726.331629] __folio_lock+0x125/0x200 [726.331634] ? find_get_entries+0x1bc/0x240 [726.331638] ? filemap_invalidate_unlock_two+0x40/0x40 [726.331642] truncate_inode_pages_range+0x5b2/0x770 [726.331649] truncate_inode_pages_final+0x44/0x50 [726.331653] btrfs_evict_inode+0x67/0x480 [726.331658] evict+0xd0/0x180 [726.331661] iput+0x13f/0x200 [726.331664] do_unlinkat+0x1c0/0x2b0 [726.331668] __x64_sys_unlink+0x23/0x30 [726.331670] do_syscall_64+0x3b/0xc0 [726.331674] entry_SYSCALL_64_after_hwframe+0x44/0xae [726.331677] RIP: 0033:0x7fb9490a171b [726.331681] RSP: 002b:00007fb943ffac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [726.331684] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9490a171b [726.331686] RDX: 00007fb943ffb040 RSI: 000055a6bbe6ec20 RDI: 00007fb94400d300 [726.331687] RBP: 00007fb943ffad00 R08: 0000000000000000 R09: 0000000000000000 [726.331688] R10: 0000000000000031 R11: 0000000000000246 R12: 00007fb943ffb000 [726.331690] R13: 00007fb943ffb040 R14: 0000000000000000 R15: 00007fb943ffd260 [726.331693] </TASK> While we debug the issue, we found running fstests generic/551 on 5GB non-zoned null_blk device in the emulated zoned mode also had a similar hung issue. Also, we can reproduce the same symptom with an error injected cow_file_range() setup. The hang occurs when cow_file_range() fails in the middle of allocation. cow_file_range() called from do_allocation_zoned() can split the give region ([start, end]) for allocation depending on current block group usages. When btrfs can allocate bytes for one part of the split regions but fails for the other region (e.g. because of -ENOSPC), we return the error leaving the pages in the succeeded regions locked. Technically, this occurs only when @unlock == 0. Otherwise, we unlock the pages in an allocated region after creating an ordered extent. Considering the callers of cow_file_range(unlock=0) won't write out the pages, we can unlock the pages on error exit from cow_file_range(). So, we can ensure all the pages except @locked_page are unlocked on error case. In summary, cow_file_range now behaves like this: - page_started == 1 (return value) - All the pages are unlocked. IO is started. - unlock == 1 - All the pages except @locked_page are unlocked in any case - unlock == 0 - On success, all the pages are locked for writing out them - On failure, all the pages except @locked_page are unlocked

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

4 references

URL	Tags
https://git.kernel.org/stable/c/b367f125c80fa838e…
https://git.kernel.org/stable/c/9535ec371d741fa03…
https://git.kernel.org/stable/c/e160aa87c87a9c4e0…
https://git.kernel.org/stable/c/9ce7466f372d83054…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 42c011000963442ce533d92a492c4a057b2f5a46 , < b367f125c80fa838eae49e3b138dc67dfc9f46ef (git) Affected: 42c011000963442ce533d92a492c4a057b2f5a46 , < 9535ec371d741fa037e37eddc0a5b25ba82d0027 (git) Affected: 42c011000963442ce533d92a492c4a057b2f5a46 , < e160aa87c87a9c4e0c8d1430235f715a3a91e2cd (git) Affected: 42c011000963442ce533d92a492c4a057b2f5a46 , < 9ce7466f372d83054c7494f6b3e4b9abaf3f0355 (git)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 5.15.61 , ≤ 5.15.* (semver) Unaffected: 5.18.18 , ≤ 5.18.* (semver) Unaffected: 5.19.2 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b367f125c80fa838eae49e3b138dc67dfc9f46ef",
              "status": "affected",
              "version": "42c011000963442ce533d92a492c4a057b2f5a46",
              "versionType": "git"
            },
            {
              "lessThan": "9535ec371d741fa037e37eddc0a5b25ba82d0027",
              "status": "affected",
              "version": "42c011000963442ce533d92a492c4a057b2f5a46",
              "versionType": "git"
            },
            {
              "lessThan": "e160aa87c87a9c4e0c8d1430235f715a3a91e2cd",
              "status": "affected",
              "version": "42c011000963442ce533d92a492c4a057b2f5a46",
              "versionType": "git"
            },
            {
              "lessThan": "9ce7466f372d83054c7494f6b3e4b9abaf3f0355",
              "status": "affected",
              "version": "42c011000963442ce533d92a492c4a057b2f5a46",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: ensure pages are unlocked on cow_file_range() failure\n\nThere is a hung_task report on zoned btrfs like below.\n\nhttps://github.com/naota/linux/issues/59\n\n  [726.328648] INFO: task rocksdb:high0:11085 blocked for more than 241 seconds.\n  [726.329839]       Not tainted 5.16.0-rc1+ #1\n  [726.330484] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [726.331603] task:rocksdb:high0   state:D stack:    0 pid:11085 ppid: 11082 flags:0x00000000\n  [726.331608] Call Trace:\n  [726.331611]  \u003cTASK\u003e\n  [726.331614]  __schedule+0x2e5/0x9d0\n  [726.331622]  schedule+0x58/0xd0\n  [726.331626]  io_schedule+0x3f/0x70\n  [726.331629]  __folio_lock+0x125/0x200\n  [726.331634]  ? find_get_entries+0x1bc/0x240\n  [726.331638]  ? filemap_invalidate_unlock_two+0x40/0x40\n  [726.331642]  truncate_inode_pages_range+0x5b2/0x770\n  [726.331649]  truncate_inode_pages_final+0x44/0x50\n  [726.331653]  btrfs_evict_inode+0x67/0x480\n  [726.331658]  evict+0xd0/0x180\n  [726.331661]  iput+0x13f/0x200\n  [726.331664]  do_unlinkat+0x1c0/0x2b0\n  [726.331668]  __x64_sys_unlink+0x23/0x30\n  [726.331670]  do_syscall_64+0x3b/0xc0\n  [726.331674]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n  [726.331677] RIP: 0033:0x7fb9490a171b\n  [726.331681] RSP: 002b:00007fb943ffac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000057\n  [726.331684] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9490a171b\n  [726.331686] RDX: 00007fb943ffb040 RSI: 000055a6bbe6ec20 RDI: 00007fb94400d300\n  [726.331687] RBP: 00007fb943ffad00 R08: 0000000000000000 R09: 0000000000000000\n  [726.331688] R10: 0000000000000031 R11: 0000000000000246 R12: 00007fb943ffb000\n  [726.331690] R13: 00007fb943ffb040 R14: 0000000000000000 R15: 00007fb943ffd260\n  [726.331693]  \u003c/TASK\u003e\n\nWhile we debug the issue, we found running fstests generic/551 on 5GB\nnon-zoned null_blk device in the emulated zoned mode also had a\nsimilar hung issue.\n\nAlso, we can reproduce the same symptom with an error injected\ncow_file_range() setup.\n\nThe hang occurs when cow_file_range() fails in the middle of\nallocation. cow_file_range() called from do_allocation_zoned() can\nsplit the give region ([start, end]) for allocation depending on\ncurrent block group usages. When btrfs can allocate bytes for one part\nof the split regions but fails for the other region (e.g. because of\n-ENOSPC), we return the error leaving the pages in the succeeded regions\nlocked. Technically, this occurs only when @unlock == 0. Otherwise, we\nunlock the pages in an allocated region after creating an ordered\nextent.\n\nConsidering the callers of cow_file_range(unlock=0) won\u0027t write out\nthe pages, we can unlock the pages on error exit from\ncow_file_range(). So, we can ensure all the pages except @locked_page\nare unlocked on error case.\n\nIn summary, cow_file_range now behaves like this:\n\n- page_started == 1 (return value)\n  - All the pages are unlocked. IO is started.\n- unlock == 1\n  - All the pages except @locked_page are unlocked in any case\n- unlock == 0\n  - On success, all the pages are locked for writing out them\n  - On failure, all the pages except @locked_page are unlocked"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:12:36.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b367f125c80fa838eae49e3b138dc67dfc9f46ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/9535ec371d741fa037e37eddc0a5b25ba82d0027"
        },
        {
          "url": "https://git.kernel.org/stable/c/e160aa87c87a9c4e0c8d1430235f715a3a91e2cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ce7466f372d83054c7494f6b3e4b9abaf3f0355"
        }
      ],
      "title": "btrfs: ensure pages are unlocked on cow_file_range() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50089",
    "datePublished": "2025-06-18T11:02:29.451Z",
    "dateReserved": "2025-06-18T10:57:27.410Z",
    "dateUpdated": "2026-05-11T19:12:36.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-785M-WWRQ-6238

CVE-2022-50089 (GCVE-0-2022-50089)

Tags

Sightings

Nomenclature

Related by attack behaviour