In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between quota enable and quota rescan ioctl
When enabling quotas, at btrfsquotaenable(), after committing the transaction, we change fsinfo->quotaroot to point to the quota root we created and set BTRFSFSQUOTAENABLED at fsinfo->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgrouprescaninit() - however if that fails we end up freeing the quota root but we leave fsinfo->quotaroot still pointing to it, this can later result in a use-after-free somewhere else.
We have previously set the flags BTRFSFSQUOTAENABLED and BTRFSQGROUPSTATUSFLAGON, so we can only fail with -EINPROGRESS at btrfsquota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker.
So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.
[
{
"id": "CVE-2022-50379-0ae1d5fb",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b5ffe86332af95f0f52be0a63d4da7c2b37b55",
"deprecated": false
},
{
"id": "CVE-2022-50379-1a6d0aae",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3832.0,
"function_hash": "29889485383963093478130969849414750836"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b5ffe86332af95f0f52be0a63d4da7c2b37b55",
"deprecated": false
},
{
"id": "CVE-2022-50379-2822ff30",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26b7c0ac49a3eea15559c9d84863736a6d1164b4",
"deprecated": false
},
{
"id": "CVE-2022-50379-2e8a3888",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3974.0,
"function_hash": "174501495804214550228849543299422417175"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0efd9dfc00d677a1d0929319a6103cb2dfc41c22",
"deprecated": false
},
{
"id": "CVE-2022-50379-395f8cdc",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3466.0,
"function_hash": "155393460039702725444008885508508881081"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26b7c0ac49a3eea15559c9d84863736a6d1164b4",
"deprecated": false
},
{
"id": "CVE-2022-50379-3c2cdb3f",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c97f6d528c3f1c83a6b792a8a7928c236c80b8fe",
"deprecated": false
},
{
"id": "CVE-2022-50379-430a0dd5",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3832.0,
"function_hash": "29889485383963093478130969849414750836"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b996a3014ef014af8f97b60c35f5289210a4720",
"deprecated": false
},
{
"id": "CVE-2022-50379-6c05a9b2",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@331cd9461412e103d07595a10289de90004ac890",
"deprecated": false
},
{
"id": "CVE-2022-50379-6f058cb0",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b996a3014ef014af8f97b60c35f5289210a4720",
"deprecated": false
},
{
"id": "CVE-2022-50379-bd5f53ce",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0efd9dfc00d677a1d0929319a6103cb2dfc41c22",
"deprecated": false
},
{
"id": "CVE-2022-50379-d40051ae",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3160.0,
"function_hash": "125730648467977591293422800860370457229"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c97f6d528c3f1c83a6b792a8a7928c236c80b8fe",
"deprecated": false
},
{
"id": "CVE-2022-50379-dd21f745",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"2999494396663977851472085067826356043",
"80732002380688690345490707348280849777",
"241005748148404195888757468487012962143",
"236332375459805895356147960732670237327"
],
"threshold": 0.9
},
"target": {
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c22f86dd221eba0c7af645b1af73dcbc04ee27b",
"deprecated": false
},
{
"id": "CVE-2022-50379-e3a6be12",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3974.0,
"function_hash": "174501495804214550228849543299422417175"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@331cd9461412e103d07595a10289de90004ac890",
"deprecated": false
},
{
"id": "CVE-2022-50379-e8a4ed39",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3974.0,
"function_hash": "174501495804214550228849543299422417175"
},
"target": {
"function": "btrfs_quota_enable",
"file": "fs/btrfs/qgroup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c22f86dd221eba0c7af645b1af73dcbc04ee27b",
"deprecated": false
}
]