CVE-2022-49296
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49296
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49296.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49296
- Downstream
- Related
- Published
- 2025-02-26T02:01:26Z
- Modified
- 2025-10-15T20:15:18.015716Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- ceph: fix possible deadlock when holding Fwb to get inline_data
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix possible deadlock when holding Fwb to get inline_data
1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0:
cephatomicopen()--> cephmdscdorequest(openc) finishopen(file, dentry, cephopen)--> cephopen()--> cephinitfile()--> cephinitfileinfo()--> cephuninlinedata()--> { ... if (inlineversion == 1 || /* initial version, no data */ inlineversion == CEPHINLINENONE) goto outunlock; ... }
The inlineversion will be 1, which is the initial version for the new create file. And here the ci->iinline_version will keep with 1, it's buggy.
3, buffer write to the file immediately:
cephwriteiter()--> cephgetcaps(file, need=Fw, want=Fb, ...); genericperformwrite()--> aops->writebegin()--> cephwritebegin()--> netfswritebegin()--> netfsbeginread()--> netfsrreqsubmitslice()--> netfsreadfromserver()--> rreq->netfsops->issueread()--> cephnetfsissueread()--> { ... if (ci->iinlineversion != CEPHINLINENONE && cephnetfsissueopinline(subreq)) return; ... } cephputcaprefs(ci, Fwb);
The cephnetfsissueopinline() will send a getattr(Fsr) request to mds.1.
4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients.
While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr).
It's deadlock!
URL: https://tracker.ceph.com/issues/55377
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9030aaf9bf0a1eee47a154c316c789e959638b0fFixed292b7a7275ce535a1abfa4dd0b2e586162aaae1e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9030aaf9bf0a1eee47a154c316c789e959638b0fFixed825978fd6a0defc3c29d8a38b6cea76a0938d21e