dm thin: Use last transaction's pmd->root when commit failed

{
  "id": "b123671c10973a245eee3c1eedb881db6d904b605179b89bc3c909a8b6c05bad",
  "url": "https://osv.dev/vulnerability/CVE-2022-50534",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "dm thin: Use last transaction's pmd->root when commit failed",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd->root when commit failed Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata: Kernel panic - not syncing: softlockup: hung tasks CPU: 7 PID: 2669225 Comm: kworker/u16:3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: dm-thin do_worker [dm_thin_pool] Call Trace: dump_stack+0x9c/0xd3 panic+0x35d/0x6b9 watchdog_timer_fn.cold+0x16/0x25 __run_hrtimer+0xa2/0x2d0 RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio] __bufio_new+0x11f/0x4f0 [dm_bufio] new_read+0xa3/0x1e0 [dm_bufio] dm_bm_read_lock+0x33/0xd0 [dm_persistent_data] ro_step+0x63/0x100 [dm_persistent_data] btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data] dm_btree_lookup+0x16f/0x210 [dm_persistent_data] dm_thin_find_block+0x12c/0x210 [dm_thin_pool] __process_bio_read_only+0xc5/0x400 [dm_thin_pool] process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool] process_one_work+0x3c5/0x730 Following process may generate a broken btree mixed with fresh and stale btree nodes, which could get dm thin trapped in an infinite loop while looking up data block: Transaction 1: pmd->root = A, A->B->C // One path in btree pmd->root = X, X->Y->Z // Copy-up Transaction 2: X,Z is updated on disk, Y write failed. // Commit failed, dm thin becomes read-only. process_bio_read_only dm_thin_find_block __find_block dm_btree_lookup(pmd->root) The pmd->root points to a broken btree, Y m",
    "evidence": "osv:CVE-2022-50534",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.9.337",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "4.14.303",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "4.19.270",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.229",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.163",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.87",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.0.18",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-50534",
      "aliases": [
        "CVE-2022-50534"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5"
                },
                {
                  "fixed": "b35a22760aa5008d82533e59b0f0b5eb1b02d4e5"
                },
                {
                  "fixed": "87d69b8824ca9b090f5a8ed47f758e8f6eecb871"
                },
                {
                  "fixed": "3db757ffdd87ed8d7118b2250236a496502a660f"
                },
                {
                  "fixed": "f758987ff0af3a4b5ee69e95cab6a5294e4367b0"
                },
                {
                  "fixed": "94f01ecc2aa0be992865acc80ebb6701f731f955"
                },
                {
                  "fixed": "4b710e8481ade7c9200e94d3018e99dc42a0a0e8"
                },
                {
                  "fixed": "a63ce4eca86fd207e3db07c00fb7ccf4adf1b230"
                },
                {
                  "fixed": "b91f481300e3a10eaf66b94fc39b740928762aaf"
                },
                {
                  "fixed": "7991dbff6849f67e823b7cc0c15e5a90b0549b9f"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50534.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.2.0"
                },
                {
                  "fixed": "4.9.337"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.10.0"
                },
                {
                  "fixed": "4.14.303"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.15.0"
                },
                {
                  "fixed": "4.19.270"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.229"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.163"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.87"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.0.18"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.1.0"
                },
                {
                  "fixed": "6.1.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50534.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.351798332Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/3db757ffdd87ed8d7118b2250236a496502a660f",
        "https://git.kernel.org/stable/c/4b710e8481ade7c9200e94d3018e99dc42a0a0e8",
        "https://git.kernel.org/stable/c/7991dbff6849f67e823b7cc0c15e5a90b0549b9f",
        "https://git.kernel.org/stable/c/87d69b8824ca9b090f5a8ed47f758e8f6eecb871",
        "https://git.kernel.org/stable/c/94f01ecc2aa0be992865acc80ebb6701f731f955",
        "https://git.kernel.org/stable/c/a63ce4eca86fd207e3db07c00fb7ccf4adf1b230",
        "https://git.kernel.org/stable/c/b35a22760aa5008d82533e59b0f0b5eb1b02d4e5",
        "https://git.kernel.org/stable/c/b91f481300e3a10eaf66b94fc39b740928762aaf",
        "https://git.kernel.org/stable/c/f758987ff0af3a4b5ee69e95cab6a5294e4367b0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50534.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-50534",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50534.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-50534",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 521982,
  "published_at": "2025-10-07T15:19:23.958+00:00"
}