{ "cveId": "CVE-2022-49079", "url": "https://patchblox.com/security/cve/CVE-2022-49079", "summary": "CVE-2022-49079 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49079, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex...", "description": "In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone btrfs_can_activate_zone() can be called with the device_list_mutex already held, which will lead to a deadlock: insert_dev_extents() // Takes device_list_mutex \u0060-\u003E insert_dev_extent() \u0060-\u003E btrfs_insert_empty_item() \u0060-\u003E btrfs_insert_empty_items() \u0060-\u003E btrfs_search_slot() \u0060-\u003E btrfs_cow_block() \u0060-\u003E __btrfs_cow_block() \u0060-\u003E btrfs_alloc_tree_block() \u0060-\u003E btrfs_reserve_extent() \u0060-\u003E find_free_extent() \u0060-\u003E find_free_extent_update_loop() \u0060-\u003E can_allocate_chunk() \u0060-\u003E btrfs_can_activate_zone() // Takes device_list_mutex again Instead of using the RCU on fs_devices-\u003Edevice_list we can use fs_devices-\u003Ealloc_list, protected by the chunk_mutex to traverse the list of active devices. We are in the chunk allocation thread. The newer chunk allocation happens from the devices in the fs_device-\u003Ealloc_list protected by the chunk_mutex. btrfs_create_chunk() lockdep_assert_held(\u0026info-\u003Echunk_mutex); gather_device_info list_for_each_entry(device, \u0026fs_devices-\u003Ealloc_list, dev_alloc_list) Also, a device that reappears after the mount won\u0027t join the alloc_list yet and, it will be in the dev_list, which we don\u0027t want to consider in the context of the chunk alloc. [15.166572] WARNING: possible recursive locking detected [15.167117] 5.17.0-rc6-dennis #79 Not tainted [15.167487] -------------------------------------------- [15.167733] kworker/u8:3/146 is trying to acquire lock: [15.167733] ffff888102962ee0 (\u0026fs_devs-\u003Edevice_list_mutex){\u002B.\u002B.}-{3:3}, at: find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.167733] [15.167733] but task is already holding lock: [15.167733] ffff888102962ee0 (\u0026fs_devs-\u003Edevice_list_mutex){\u002B.\u002B.}-{3:3}, at: btrfs_create_pending_block_groups\u002B0x20a/0x560 [btrfs] [15.167733] [15.167733] other info that might help us debug this: [15.167733] Possible unsafe locking scenario: [15.167733] [15.171834] CPU0 [15.171834] ---- [15.171834] lock(\u0026fs_devs-\u003Edevice_list_mutex); [15.171834] lock(\u0026fs_devs-\u003Edevice_list_mutex); [15.171834] [15.171834] *** DEADLOCK *** [15.171834] [15.171834] May be due to missing lock nesting notation [15.171834] [15.171834] 5 locks held by kworker/u8:3/146: [15.171834] #0: ffff888100050938 ((wq_completion)events_unbound){\u002B.\u002B.}-{0:0}, at: process_one_work\u002B0x1c3/0x5a0 [15.171834] #1: ffffc9000067be80 ((work_completion)(\u0026fs_info-\u003Easync_data_reclaim_work)){\u002B.\u002B.}-{0:0}, at: process_one_work\u002B0x1c3/0x5a0 [15.176244] #2: ffff88810521e620 (sb_internal){.\u002B.\u002B}-{0:0}, at: flush_space\u002B0x335/0x600 [btrfs] [15.176244] #3: ffff888102962ee0 (\u0026fs_devs-\u003Edevice_list_mutex){\u002B.\u002B.}-{3:3}, at: btrfs_create_pending_block_groups\u002B0x20a/0x560 [btrfs] [15.176244] #4: ffff8881152e4b78 (btrfs-dev-00){\u002B\u002B\u002B\u002B}-{3:3}, at: __btrfs_tree_lock\u002B0x27/0x130 [btrfs] [15.179641] [15.179641] stack backtrace: [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79 [15.179641] Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 [15.179641] Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] [15.179641] Call Trace: [15.179641] \u003CTASK\u003E [15.179641] dump_stack_lvl\u002B0x45/0x59 [15.179641] __lock_acquire.cold\u002B0x217/0x2b2 [15.179641] lock_acquire\u002B0xbf/0x2b0 [15.183838] ? find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.183838] __mutex_lock\u002B0x8e/0x970 [15.183838] ? find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.183838] ? find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.183838] ? lock_is_held_type\u002B0xd7/0x130 [15.183838] ? find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.183838] find_free_extent\u002B0x15a/0x14f0 [btrfs] [15.183838] ? _raw_spin_unlock\u002B0x24/0x40 [15.183838] ? btrfs_get_alloc_profile\u002B0x106/0x230 [btrfs] [15.187601] btrfs_reserve_extent\u002B0x131/0x260 [btrfs] [15. ---truncated---", "published": "2025-02-26T07:00:45Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00184, "epssPercentile": 0.08074, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "5.17.3-1", "fix": "DEBIAN-CVE-2022-49079", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49079", "released": "2025-02-26T07:00:45Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "5.17.3-1", "fix": "DEBIAN-CVE-2022-49079", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49079", "released": "2025-02-26T07:00:45Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "5.17.3-1", "fix": "DEBIAN-CVE-2022-49079", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49079", "released": "2025-02-26T07:00:45Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T06:59:42Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }