CVE-2022-49068: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49068 is a vulnerability in the Linux kernel's btrfs filesystem that affects the direct IO write path. The issue was discovered in 2022 and involves incorrect release of delalloc (delayed allocation) amounts during direct IO write operations. The vulnerability affects Linux kernel versions prior to the patch implementation (Kernel Git).

The vulnerability occurs in the btrfs_get_blocks_direct_write() function where temporary outstanding extents are reserved using btrfs_delalloc_reserve_metadata() or indirectly through btrfs_delalloc_reserve_space(). The issue arises when the 'len' parameter is modified in the COW (Copy-On-Write) case, resulting in fewer outstanding extents being released than expected. This leads to a memory leak condition that manifests as outstanding extents remaining after filesystem operations (Kernel Git).

The vulnerability can result in memory leaks due to unreleased outstanding extents. This condition becomes particularly apparent during filesystem unmount operations, where it triggers warnings about remaining outstanding extents. The issue is most noticeable on filesystems of approximately 1 GiB in size, especially when attempting to allocate large extents that result in smaller allocations (Kernel Git).

The vulnerability requires local access to a system running the affected Linux kernel version with btrfs filesystem. It primarily manifests during specific filesystem operations, particularly when performing direct IO writes that trigger COW operations on a btrfs filesystem (Kernel Git).

The issue has been fixed by modifying the code to call btrfs_delalloc_release_extents() with the original length (prev_len) instead of the potentially modified length. The fix ensures proper cleanup of outstanding extents during direct IO write operations. Users should update to a patched kernel version that includes this fix (Kernel Git).