In the Linux kernel, the following vulnerability has been resolved:
btrfs: output extra debug info if we failed to find an inline backref
[BUG] Syzbot reported several warning triggered inside lookupinlineextent_backref().
[CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist)
[ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53672.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53672.json"
[
{
"id": "CVE-2023-53672-115a59fa",
"target": {
"function": "lookup_inline_extent_backref",
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28062cd6eda04035d8f6ded2001292ac8b496149",
"digest": {
"function_hash": "166309351251742281747143923710018990474",
"length": 3477.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53672-1f50b25f",
"target": {
"function": "lookup_inline_extent_backref",
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6994f806c6d1ae8b59344d3700358547f3b3fe1d",
"digest": {
"function_hash": "145705007320375700149916790984351417374",
"length": 3229.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53672-23da02dc",
"target": {
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28062cd6eda04035d8f6ded2001292ac8b496149",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280416581380405184786132437030791788821",
"53279391389295143046252190717891553470",
"276821040141100594801011970685144112661",
"148064266309506690120674164957704843710"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53672-4484d5eb",
"target": {
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6994f806c6d1ae8b59344d3700358547f3b3fe1d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280416581380405184786132437030791788821",
"53279391389295143046252190717891553470",
"276821040141100594801011970685144112661",
"148064266309506690120674164957704843710"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53672-476a2255",
"target": {
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e70ba449b04b40584bdabb383d10455397cbf177",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280416581380405184786132437030791788821",
"53279391389295143046252190717891553470",
"276821040141100594801011970685144112661",
"148064266309506690120674164957704843710"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53672-71670879",
"target": {
"function": "lookup_inline_extent_backref",
"file": "fs/btrfs/extent-tree.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e70ba449b04b40584bdabb383d10455397cbf177",
"digest": {
"function_hash": "166309351251742281747143923710018990474",
"length": 3477.0
},
"signature_type": "Function"
}
]