{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50067","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-06-18T10:57:27.405Z","datePublished":"2025-06-18T11:02:13.127Z","dateUpdated":"2026-05-11T19:12:13.557Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:12:13.557Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated.  Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n  prepare_to_relocate()\n    set_reloc_control()\n\nthat assigns rc to the variable fs_info->reloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n  btrfs_start_dirty_block_groups()\n    btrfs_alloc_path()\n      kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn't set fs_info->reloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info->reloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  ...\n  [   58.753577] Call Trace:\n  ...\n  [   58.755800]  kasan_report+0x45/0x60\n  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]\n  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]\n  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]\n  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n  ...\n  [   58.768510] Allocated by task 23683:\n  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0\n  [   58.769069]  __kmalloc+0x227/0x3d0\n  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]\n  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...\n  [   58.773337] Freed by task 23683:\n  ...\n  [   58.774815]  kfree+0xda/0x2b0\n  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]\n  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ..."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/relocation.c"],"versions":[{"version":"1a5353475df8fcaf200fecc9e961a3900d15e891","lessThan":"ff0e8ed8dfb584575cffc1561f17a1d094e8565b","status":"affected","versionType":"git"},{"version":"499d29bf151951399367ba83645abfdb429a3af9","lessThan":"dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f","status":"affected","versionType":"git"},{"version":"4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3","lessThan":"8e546674031fc1576da501e27a8fd165222e5a37","status":"affected","versionType":"git"},{"version":"6f371623f315c26100e603c2e8837cdbe130f9e0","lessThan":"b60e862e133f646f19023ece1d476d630a660de1","status":"affected","versionType":"git"},{"version":"fb686c6824dd6294ca772b92424b8fba666e7d00","lessThan":"78f8c2370e3d33e35f23bdc648653d779aeacb6e","status":"affected","versionType":"git"},{"version":"fb686c6824dd6294ca772b92424b8fba666e7d00","lessThan":"5d741afed0bac206640cc64d77b97853283cf719","status":"affected","versionType":"git"},{"version":"fb686c6824dd6294ca772b92424b8fba666e7d00","lessThan":"85f02d6c856b9f3a0acf5219de6e32f58b9778eb","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/relocation.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.15.63","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.19.4","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.63"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b"},{"url":"https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f"},{"url":"https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37"},{"url":"https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1"},{"url":"https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e"},{"url":"https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719"},{"url":"https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb"}],"title":"btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()","x_generator":{"engine":"bippy-1.2.0"}}}}