In the Linux kernel, the following vulnerability has been resolved:
btrfs: remove BUG() after failure to insert delayed dir index item
Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfsinsertdelayeddirindex() or BUG_ON (when creating pending snapshots in the transaction commit path).
So remove the BUG() call and do proper error handling.
This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c58c3931ede7cd08cbecf1f1a4acaf0a04a41a9",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "btrfs_insert_delayed_dir_index",
"file": "fs/btrfs/delayed-inode.c"
},
"id": "CVE-2023-52569-44da3d54",
"digest": {
"length": 1946.0,
"function_hash": "249725958558872472866647225954789926464"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d10fd53393cc5de4b9cf1a4b8f9984f0a037aa51",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/btrfs/delayed-inode.c"
},
"id": "CVE-2023-52569-a294c3dc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65920109982705379772440571590030362499",
"317331423117746878934171743326382682423",
"170379339769164686812544147720537029118",
"66535326590937402555864769760587132815",
"171526783432374289132540149342093545797",
"284651832447989901117923099223109789794",
"128718137485622225573560892661093395841",
"230581579296175271309994345392109790484",
"212899011719093776337999289950893871702",
"309023375458184456680104420916224271125",
"265324015958627735195586221222453367590",
"120274272488175963796105005045078061879",
"309060893827153250801073983904672657111",
"315945364147443474278649206062113661754",
"334403112517571818203033280816872641676",
"144752640361260998927034326886083325964",
"189551459119892754026619806742534240851",
"178783132718128965687642287457144426408",
"217478892367720847626531236886278978026",
"200912860648026874074268920540294913548",
"164660499808143517032650742203826157889",
"268042117035935698914221967285809869540",
"108962464107726722490275411085932428179",
"94439398515240546754500296470431018469",
"159417599362310429853799783168641494495",
"40421433737005611247012843294961698947",
"317884526251662483142716757283968710837",
"100359895288460866058064368549433373200",
"309795960690787667087085624115321197227",
"10682073857208098174438941577859249231"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d10fd53393cc5de4b9cf1a4b8f9984f0a037aa51",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "btrfs_insert_delayed_dir_index",
"file": "fs/btrfs/delayed-inode.c"
},
"id": "CVE-2023-52569-a7b0363e",
"digest": {
"length": 1946.0,
"function_hash": "249725958558872472866647225954789926464"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c58c3931ede7cd08cbecf1f1a4acaf0a04a41a9",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/btrfs/delayed-inode.c"
},
"id": "CVE-2023-52569-f01f65c9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65920109982705379772440571590030362499",
"317331423117746878934171743326382682423",
"170379339769164686812544147720537029118",
"66535326590937402555864769760587132815",
"171526783432374289132540149342093545797",
"284651832447989901117923099223109789794",
"128718137485622225573560892661093395841",
"230581579296175271309994345392109790484",
"212899011719093776337999289950893871702",
"309023375458184456680104420916224271125",
"265324015958627735195586221222453367590",
"120274272488175963796105005045078061879",
"309060893827153250801073983904672657111",
"315945364147443474278649206062113661754",
"334403112517571818203033280816872641676",
"144752640361260998927034326886083325964",
"189551459119892754026619806742534240851",
"178783132718128965687642287457144426408",
"217478892367720847626531236886278978026",
"200912860648026874074268920540294913548",
"164660499808143517032650742203826157889",
"268042117035935698914221967285809869540",
"108962464107726722490275411085932428179",
"94439398515240546754500296470431018469",
"159417599362310429853799783168641494495",
"40421433737005611247012843294961698947",
"317884526251662483142716757283968710837",
"100359895288460866058064368549433373200",
"309795960690787667087085624115321197227",
"10682073857208098174438941577859249231"
]
},
"signature_type": "Line"
}
]