CVE-2022-50067

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()

In btrfs_relocate_block_group(), the rc is allocated. Then

btrfs_relocate_block_group() calls

relocate_block_group()

prepare_to_relocate()

set_reloc_control()

that assigns rc to the variable fs_info->reloc_ctl. When

prepare_to_relocate() returns, it calls

btrfs_commit_transaction()

btrfs_start_dirty_block_groups()

btrfs_alloc_path()

kmem_cache_zalloc()

which may fail for example (or other errors could happen). When the

failure occurs, btrfs_relocate_block_group() detects the error and frees

rc and doesn't set fs_info->reloc_ctl to NULL. After that, in

btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and

then used, which may cause a use-after-free bug.

This possible bug can be triggered by calling btrfs_ioctl_balance()

before calling btrfs_ioctl_defrag().

To fix this possible bug, in prepare_to_relo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References