In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix BUGON condition in btrfscancel_balance
Pausing and canceling balance can race to interrupt balance lead to BUGON panic in btrfscancelbalance. The BUGON condition in btrfscancelbalance does not take this race scenario into account.
However, the race condition has no other side effects. We can fix that.
Reproducing it with panic trace like this:
kernel BUG at fs/btrfs/volumes.c:4618! RIP: 0010:btrfscancelbalance+0x5cf/0x6a0 Call Trace: <TASK> ? donanosleep+0x60/0x120 ? hrtimernanosleep+0xb7/0x1a0 ? schedcoreclonecookie+0x70/0x70 btrfsioctlbalancectl+0x55/0x70 btrfsioctl+0xa46/0xd20 _x64sysioctl+0x7d/0xa0 dosyscall64+0x38/0x80 entrySYSCALL64afterhwframe+0x63/0xcd
Race scenario as follows:
mutexunlock(&fsinfo->balance_mutex);
.......issue pause and cancel req in another thread
ret = _btrfsbalance(fs_info);
mutexlock(&fsinfo->balancemutex); if (ret == -ECANCELED && atomicread(&fsinfo->balancepausereq)) { btrfsinfo(fsinfo, "balance: paused"); btrfsexclopbalance(fsinfo, BTRFSEXCLOPBALANCE_PAUSED); }
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-20478657",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b966e9e1e250dfdb41a7f41775faea4a37af923c",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-2d23a332",
"digest": {
"function_hash": "116555029027991237950190012911342970961",
"length": 984.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a462a0f20926918d6009f0b4b25673e883fc98",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-501558aa",
"digest": {
"function_hash": "202634722177278136586315606211148362935",
"length": 954.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae81329f7de3aa6f34ecdfa5412e72161a30e9ce",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-5982ed99",
"digest": {
"function_hash": "202634722177278136586315606211148362935",
"length": 954.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd7bef82ce0e929ef4cf63a34990545aaca28077",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-97aa2c91",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29eefa6d0d07e185f7bfe9576f91e6dba98189c2",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-aaa65370",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae81329f7de3aa6f34ecdfa5412e72161a30e9ce",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-b33a30d6",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceb9ba8e30833a4823e2dc73f80ebcdf2498d01a",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-cfd00e76",
"digest": {
"function_hash": "202634722177278136586315606211148362935",
"length": 954.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29eefa6d0d07e185f7bfe9576f91e6dba98189c2",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-d6070a62",
"digest": {
"function_hash": "116555029027991237950190012911342970961",
"length": 984.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c93b89cd46636b5e74c12fa21dd86167bc6ea8d",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-dac3fbcd",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c93b89cd46636b5e74c12fa21dd86167bc6ea8d",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-deeeacda",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a462a0f20926918d6009f0b4b25673e883fc98",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-e3c37506",
"digest": {
"function_hash": "202634722177278136586315606211148362935",
"length": 954.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceb9ba8e30833a4823e2dc73f80ebcdf2498d01a",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-ea85863f",
"digest": {
"function_hash": "202634722177278136586315606211148362935",
"length": 954.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b966e9e1e250dfdb41a7f41775faea4a37af923c",
"signature_type": "Function",
"target": {
"function": "btrfs_cancel_balance",
"file": "fs/btrfs/volumes.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53339-f85d07a7",
"digest": {
"line_hashes": [
"245448621750464202213170368731826700763",
"248955292669570675514011346020598649265",
"44695851979832215411290271817360065797",
"265824092732182460331391540591835134544",
"303407947845103042358555441755290278686"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd7bef82ce0e929ef4cf63a34990545aaca28077",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/volumes.c"
}
}
]