CVE-2022-49327: bcache: avoid journal no-space deadlock by reserving 1 journal bucket
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: bcache: avoid journal no-space deadlock by reserving 1 journal bucket The journal no-space deadlock was reported time to time. Such deadlock can happen in the following situation. When all journal buckets are fully filled by active jset with heavy write I/O load, the cache set registration (after a reboot) will load all active jsets and inserting them into the btree again (which is called journal replay). If a journaled bkey is inserted into a btree node and results btree node split, new journal request might be triggered. For example, the btree grows one more level after the node split, then the root node record in cache device super block will be upgrade by bch_journal_meta() from bch_btree_set_root(). But there is no space in journal buckets, the journal replay has to wait for new journal bucket to be reclaimed after at least one journal bucket replayed. This is one example that how the journal no-space deadlock happens. The solution to avoid the deadlock is to reserve 1 journal bucket in run time, and only permit the reserved journal bucket to be used during cache set registration procedure for things like journal replay. Then the journal space will never be fully filled, there is no chance for journal no-space deadlock to happen anymore. This patch adds a new member "bool do_reserve" in struct journal, it is inititalized to 0 (false) when struct journal is allocated, and set to 1 (true) by bch_journal_space_reserve() when all initialization done in run_cache_set(). In the run time when journal_reclaim() tries to allocate a new journal bucket, free_journal_buckets() is called to check whether there are enough free journal buckets to use. If there is only 1 free journal bucket and journal->do_reserve is 1 (true), the last bucket is reserved and free_journal_buckets() will return 0 to indicate no free journal bucket. Then journal_reclaim() will give up, and try next time to see whetheer there is free journal bucket to allocate. By this method, there is always 1 jouranl bucket reserved in run time. During the cache set registration, journal->do_reserve is 0 (false), so the reserved journal bucket can be used to avoid the no-space deadlock.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | = | |
| Linux Kernel | <5.10.121 | |
| Linux Kernel | >=5.11<5.15.46 | |
| Linux Kernel | >=5.16<5.17.14 | |
| Linux Kernel | >=5.18<5.18.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/59afd4f287900c8187e968a4153ed35e6b48efce
- https://git.kernel.org/stable/c/5607652823ac65e2c6885e73bd46d5a4f9a20363
- https://git.kernel.org/stable/c/6332ea3e35efa12dc08f0cbf5faea5e6e8eb0497
- https://git.kernel.org/stable/c/1dda32aed6f62c163f38ff947ef5b3360e329159
- https://git.kernel.org/stable/c/32feee36c30ea06e38ccb8ae6e5c44c6eec790a6
Frequently Asked Questions
What is the severity of CVE-2022-49327?
The CVE-2022-49327 vulnerability is considered to have a moderate severity due to its potential for causing deadlock situations.
How do I fix CVE-2022-49327?
To resolve CVE-2022-49327, upgrade to a patched version of the Linux Kernel that includes the fix for the journal no-space deadlock.
What systems are affected by CVE-2022-49327?
CVE-2022-49327 affects several versions of the Linux Kernel ranging from versions 5.11 up to 5.18.3.
What impact does CVE-2022-49327 have on Linux systems?
CVE-2022-49327 can lead to a journal no-space deadlock, which may cause system performance issues or unresponsiveness.
Is CVE-2022-49327 a critical vulnerability?
CVE-2022-49327 is not classified as critical but can still result in significant operational disruptions in affected environments.
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/type
- agent/title
- agent/references
- agent/source
- agent/author
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/linux foundation
- canonical/linux kernel
- vendor/linux
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/5.18