{"id":"DEBIAN-CVE-2022-49296","details":"In the Linux kernel, the following vulnerability has been resolved:  ceph: fix possible deadlock when holding Fwb to get inline_data  1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0:     ceph_atomic_open()--\u003e      ceph_mdsc_do_request(openc)      finish_open(file, dentry, ceph_open)--\u003e        ceph_open()--\u003e          ceph_init_file()--\u003e            ceph_init_file_info()--\u003e              ceph_uninline_data()--\u003e              {                ...                if (inline_version == 1 || /* initial version, no data */                    inline_version == CEPH_INLINE_NONE)                      goto out_unlock;                ...              }  The inline_version will be 1, which is the initial version for the new create file. And here the ci-\u003ei_inline_version will keep with 1, it's buggy.  3, buffer write to the file immediately:     ceph_write_iter()--\u003e      ceph_get_caps(file, need=Fw, want=Fb, ...);      generic_perform_write()--\u003e        a_ops-\u003ewrite_begin()--\u003e          ceph_write_begin()--\u003e            netfs_write_begin()--\u003e              netfs_begin_read()--\u003e                netfs_rreq_submit_slice()--\u003e                  netfs_read_from_server()--\u003e                    rreq-\u003enetfs_ops-\u003eissue_read()--\u003e                      ceph_netfs_issue_read()--\u003e                      {                        ...                        if (ci-\u003ei_inline_version != CEPH_INLINE_NONE &&                            ceph_netfs_issue_op_inline(subreq))                          return;                        ...                      }      ceph_put_cap_refs(ci, Fwb);  The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1.  4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --\u003e sync, but it need to revoke the Fxwb caps back from the clients.  While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr).  It's deadlock!  URL: https://tracker.ceph.com/issues/55377","modified":"2026-09-01T20:04:54.333202894Z","published":"2025-02-26T07:01:06.433Z","upstream":["CVE-2022-49296"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49296"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49296.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49296.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49296.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}