CVE-2023-54023
- Source
- https://cve.org/CVERecord?id=CVE-2023-54023
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54023.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-54023
- Downstream
- Related
- Published
- 2025-12-24T10:55:52.835Z
- Modified
- 2026-03-23T05:01:15.536359038Z
- Summary
- btrfs: fix race between balance and cancel/pause
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between balance and cancel/pause
Syzbot reported a panic that looks like this:
assertion failed: fsinfo->exclusiveoperation == BTRFSEXCLOPBALANCEPAUSED, in fs/btrfs/ioctl.c:465 ------------[ cut here ]------------ kernel BUG at fs/btrfs/messages.c:259! RIP: 0010:btrfsassertfail+0x2c/0x30 fs/btrfs/messages.c:259 Call Trace: <TASK> btrfsexclopbalance fs/btrfs/ioctl.c:465 [inline] btrfsioctlbalance fs/btrfs/ioctl.c:3564 [inline] btrfsioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:870 [inline] __sesysioctl fs/ioctl.c:856 [inline] __x64sysioctl+0x197/0x210 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x39/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
The reproducer is running a balance and a cancel or pause in parallel. The way balance finishes is a bit wonky, if we were paused we need to save the balancectl in the fsinfo, but clear it otherwise and cleanup. However we rely on the return values being specific errors, or having a cancel request or no pause request. If balance completes and returns 0, but we have a pause or cancel request we won't do the appropriate cleanup, and then the next time we try to start a balance we'll trip this ASSERT.
The error handling is just wrong here, we always want to clean up, unless we got -ECANCELLED and we set the appropriate pause flag in the exclusive op. With this patch the reproducer ran for an hour without tripping, previously it would trip in less than a few minutes.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54023.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/72efe5d44821e38540888a5fe3ff3d0faab6acad
- https://git.kernel.org/stable/c/b19c98f237cd76981aaded52c258ce93f7daa8cb
- https://git.kernel.org/stable/c/ddf7e8984c83aee9122552529f4e77291903f8d9
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54023.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-54023
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced837d5b6e46d1a4af5b6cc8f2fe83cb5de79a2961Fixedddf7e8984c83aee9122552529f4e77291903f8d9Fixed72efe5d44821e38540888a5fe3ff3d0faab6acadFixedb19c98f237cd76981aaded52c258ce93f7daa8cb