CVE-2022-50090

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size

On zoned filesystem, data write out is limited by max_zone_append_size,

and a large ordered extent is split according the size of a bio. OTOH,

the number of extents to be written is calculated using

BTRFS_MAX_EXTENT_SIZE, and that estimated number is used to reserve the

metadata bytes to update and/or create the metadata items.

The metadata reservation is done at e.g, btrfs_buffered_write() and then

released according to the estimation changes. Thus, if the number of extent

increases massively, the reserved metadata can run out.

The increase of the number of extents easily occurs on zoned filesystem

if BTRFS_MAX_EXTENT_SIZE > max_zone_append_size. And, it causes the

following warning on a small RAM environment with disabling metadata

over-commit (in the following patch).

[75721.498492] ------------[ cut here ]------------

[75721.505624] BTRFS: bloc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References