CVE-2022-50534 (GCVE-0-2022-50534)
Vulnerability from cvelistv5
Published
2025-10-07 15:19
Modified
2025-10-07 15:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd->root when commit failed Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata: Kernel panic - not syncing: softlockup: hung tasks CPU: 7 PID: 2669225 Comm: kworker/u16:3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: dm-thin do_worker [dm_thin_pool] Call Trace: <IRQ> dump_stack+0x9c/0xd3 panic+0x35d/0x6b9 watchdog_timer_fn.cold+0x16/0x25 __run_hrtimer+0xa2/0x2d0 </IRQ> RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio] __bufio_new+0x11f/0x4f0 [dm_bufio] new_read+0xa3/0x1e0 [dm_bufio] dm_bm_read_lock+0x33/0xd0 [dm_persistent_data] ro_step+0x63/0x100 [dm_persistent_data] btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data] dm_btree_lookup+0x16f/0x210 [dm_persistent_data] dm_thin_find_block+0x12c/0x210 [dm_thin_pool] __process_bio_read_only+0xc5/0x400 [dm_thin_pool] process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool] process_one_work+0x3c5/0x730 Following process may generate a broken btree mixed with fresh and stale btree nodes, which could get dm thin trapped in an infinite loop while looking up data block: Transaction 1: pmd->root = A, A->B->C // One path in btree pmd->root = X, X->Y->Z // Copy-up Transaction 2: X,Z is updated on disk, Y write failed. // Commit failed, dm thin becomes read-only. process_bio_read_only dm_thin_find_block __find_block dm_btree_lookup(pmd->root) The pmd->root points to a broken btree, Y may contain stale node pointing to any block, for example X, which gets dm thin trapped into a dead loop while looking up Z. Fix this by setting pmd->root in __open_metadata(), so that dm thin will use the last transaction's pmd->root if commit failed. Fetch a reproducer in [Link]. Linke: https://bugzilla.kernel.org/show_bug.cgi?id=216790
References
Impacted products
Vendor Product Version
Linux Linux Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin-metadata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b35a22760aa5008d82533e59b0f0b5eb1b02d4e5",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "87d69b8824ca9b090f5a8ed47f758e8f6eecb871",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "3db757ffdd87ed8d7118b2250236a496502a660f",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "f758987ff0af3a4b5ee69e95cab6a5294e4367b0",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "94f01ecc2aa0be992865acc80ebb6701f731f955",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "4b710e8481ade7c9200e94d3018e99dc42a0a0e8",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "a63ce4eca86fd207e3db07c00fb7ccf4adf1b230",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "b91f481300e3a10eaf66b94fc39b740928762aaf",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            },
            {
              "lessThan": "7991dbff6849f67e823b7cc0c15e5a90b0549b9f",
              "status": "affected",
              "version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin-metadata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: Use last transaction\u0027s pmd-\u003eroot when commit failed\n\nRecently we found a softlock up problem in dm thin pool btree lookup\ncode due to corrupted metadata:\n\n Kernel panic - not syncing: softlockup: hung tasks\n CPU: 7 PID: 2669225 Comm: kworker/u16:3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n Workqueue: dm-thin do_worker [dm_thin_pool]\n Call Trace:\n   \u003cIRQ\u003e\n   dump_stack+0x9c/0xd3\n   panic+0x35d/0x6b9\n   watchdog_timer_fn.cold+0x16/0x25\n   __run_hrtimer+0xa2/0x2d0\n   \u003c/IRQ\u003e\n   RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio]\n   __bufio_new+0x11f/0x4f0 [dm_bufio]\n   new_read+0xa3/0x1e0 [dm_bufio]\n   dm_bm_read_lock+0x33/0xd0 [dm_persistent_data]\n   ro_step+0x63/0x100 [dm_persistent_data]\n   btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data]\n   dm_btree_lookup+0x16f/0x210 [dm_persistent_data]\n   dm_thin_find_block+0x12c/0x210 [dm_thin_pool]\n   __process_bio_read_only+0xc5/0x400 [dm_thin_pool]\n   process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool]\n   process_one_work+0x3c5/0x730\n\nFollowing process may generate a broken btree mixed with fresh and\nstale btree nodes, which could get dm thin trapped in an infinite loop\nwhile looking up data block:\n Transaction 1: pmd-\u003eroot = A, A-\u003eB-\u003eC   // One path in btree\n                pmd-\u003eroot = X, X-\u003eY-\u003eZ   // Copy-up\n Transaction 2: X,Z is updated on disk, Y write failed.\n                // Commit failed, dm thin becomes read-only.\n                process_bio_read_only\n\t\t dm_thin_find_block\n\t\t  __find_block\n\t\t   dm_btree_lookup(pmd-\u003eroot)\nThe pmd-\u003eroot points to a broken btree, Y may contain stale node\npointing to any block, for example X, which gets dm thin trapped into\na dead loop while looking up Z.\n\nFix this by setting pmd-\u003eroot in __open_metadata(), so that dm thin\nwill use the last transaction\u0027s pmd-\u003eroot if commit failed.\n\nFetch a reproducer in [Link].\n\nLinke: https://bugzilla.kernel.org/show_bug.cgi?id=216790"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-07T15:19:23.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b35a22760aa5008d82533e59b0f0b5eb1b02d4e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/87d69b8824ca9b090f5a8ed47f758e8f6eecb871"
        },
        {
          "url": "https://git.kernel.org/stable/c/3db757ffdd87ed8d7118b2250236a496502a660f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f758987ff0af3a4b5ee69e95cab6a5294e4367b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/94f01ecc2aa0be992865acc80ebb6701f731f955"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b710e8481ade7c9200e94d3018e99dc42a0a0e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a63ce4eca86fd207e3db07c00fb7ccf4adf1b230"
        },
        {
          "url": "https://git.kernel.org/stable/c/b91f481300e3a10eaf66b94fc39b740928762aaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/7991dbff6849f67e823b7cc0c15e5a90b0549b9f"
        }
      ],
      "title": "dm thin: Use last transaction\u0027s pmd-\u003eroot when commit failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50534",
    "datePublished": "2025-10-07T15:19:23.958Z",
    "dateReserved": "2025-10-07T15:15:38.665Z",
    "dateUpdated": "2025-10-07T15:19:23.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50534\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:37.530\",\"lastModified\":\"2025-10-08T19:38:32.610\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm thin: Use last transaction\u0027s pmd-\u003eroot when commit failed\\n\\nRecently we found a softlock up problem in dm thin pool btree lookup\\ncode due to corrupted metadata:\\n\\n Kernel panic - not syncing: softlockup: hung tasks\\n CPU: 7 PID: 2669225 Comm: kworker/u16:3\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n Workqueue: dm-thin do_worker [dm_thin_pool]\\n Call Trace:\\n   \u003cIRQ\u003e\\n   dump_stack+0x9c/0xd3\\n   panic+0x35d/0x6b9\\n   watchdog_timer_fn.cold+0x16/0x25\\n   __run_hrtimer+0xa2/0x2d0\\n   \u003c/IRQ\u003e\\n   RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio]\\n   __bufio_new+0x11f/0x4f0 [dm_bufio]\\n   new_read+0xa3/0x1e0 [dm_bufio]\\n   dm_bm_read_lock+0x33/0xd0 [dm_persistent_data]\\n   ro_step+0x63/0x100 [dm_persistent_data]\\n   btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data]\\n   dm_btree_lookup+0x16f/0x210 [dm_persistent_data]\\n   dm_thin_find_block+0x12c/0x210 [dm_thin_pool]\\n   __process_bio_read_only+0xc5/0x400 [dm_thin_pool]\\n   process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool]\\n   process_one_work+0x3c5/0x730\\n\\nFollowing process may generate a broken btree mixed with fresh and\\nstale btree nodes, which could get dm thin trapped in an infinite loop\\nwhile looking up data block:\\n Transaction 1: pmd-\u003eroot = A, A-\u003eB-\u003eC   // One path in btree\\n                pmd-\u003eroot = X, X-\u003eY-\u003eZ   // Copy-up\\n Transaction 2: X,Z is updated on disk, Y write failed.\\n                // Commit failed, dm thin becomes read-only.\\n                process_bio_read_only\\n\\t\\t dm_thin_find_block\\n\\t\\t  __find_block\\n\\t\\t   dm_btree_lookup(pmd-\u003eroot)\\nThe pmd-\u003eroot points to a broken btree, Y may contain stale node\\npointing to any block, for example X, which gets dm thin trapped into\\na dead loop while looking up Z.\\n\\nFix this by setting pmd-\u003eroot in __open_metadata(), so that dm thin\\nwill use the last transaction\u0027s pmd-\u003eroot if commit failed.\\n\\nFetch a reproducer in [Link].\\n\\nLinke: https://bugzilla.kernel.org/show_bug.cgi?id=216790\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3db757ffdd87ed8d7118b2250236a496502a660f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4b710e8481ade7c9200e94d3018e99dc42a0a0e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7991dbff6849f67e823b7cc0c15e5a90b0549b9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87d69b8824ca9b090f5a8ed47f758e8f6eecb871\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/94f01ecc2aa0be992865acc80ebb6701f731f955\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a63ce4eca86fd207e3db07c00fb7ccf4adf1b230\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b35a22760aa5008d82533e59b0f0b5eb1b02d4e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b91f481300e3a10eaf66b94fc39b740928762aaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f758987ff0af3a4b5ee69e95cab6a5294e4367b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.