CVE-2023-54002

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix assertion of exclop condition when starting balance<br /> <br /> Balance as exclusive state is compatible with paused balance and device<br /> add, which makes some things more complicated. The assertion of valid<br /> states when starting from paused balance needs to take into account two<br /> more states, the combinations can be hit when there are several threads<br /> racing to start balance and device add. This won&amp;#39;t typically happen when<br /> the commands are started from command line.<br /> <br /> Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE.<br /> <br /> Concurrently adding multiple devices to the same mount point and<br /> btrfs_exclop_finish executed finishes before assertion in<br /> btrfs_exclop_balance, exclusive_operation will changed to<br /> BTRFS_EXCLOP_NONE state which lead to assertion failed:<br /> <br /> fs_info-&gt;exclusive_operation == BTRFS_EXCLOP_BALANCE ||<br /> fs_info-&gt;exclusive_operation == BTRFS_EXCLOP_DEV_ADD,<br /> in fs/btrfs/ioctl.c:456<br /> Call Trace:<br /> <br /> btrfs_exclop_balance+0x13c/0x310<br /> ? memdup_user+0xab/0xc0<br /> ? PTR_ERR+0x17/0x20<br /> btrfs_ioctl_add_dev+0x2ee/0x320<br /> btrfs_ioctl+0x9d5/0x10d0<br /> ? btrfs_ioctl_encoded_write+0xb80/0xb80<br /> __x64_sys_ioctl+0x197/0x210<br /> do_syscall_64+0x3c/0xb0<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED.<br /> <br /> Concurrently adding multiple devices to the same mount point and<br /> btrfs_exclop_balance executed finish before the latter thread execute<br /> assertion in btrfs_exclop_balance, exclusive_operation will changed to<br /> BTRFS_EXCLOP_BALANCE_PAUSED state which lead to assertion failed:<br /> <br /> fs_info-&gt;exclusive_operation == BTRFS_EXCLOP_BALANCE ||<br /> fs_info-&gt;exclusive_operation == BTRFS_EXCLOP_DEV_ADD ||<br /> fs_info-&gt;exclusive_operation == BTRFS_EXCLOP_NONE,<br /> fs/btrfs/ioctl.c:458<br /> Call Trace:<br /> <br /> btrfs_exclop_balance+0x240/0x410<br /> ? memdup_user+0xab/0xc0<br /> ? PTR_ERR+0x17/0x20<br /> btrfs_ioctl_add_dev+0x2ee/0x320<br /> btrfs_ioctl+0x9d5/0x10d0<br /> ? btrfs_ioctl_encoded_write+0xb80/0xb80<br /> __x64_sys_ioctl+0x197/0x210<br /> do_syscall_64+0x3c/0xb0<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> An example of the failed assertion is below, which shows that the<br /> paused balance is also needed to be checked.<br /> <br /> root@syzkaller:/home/xsk# ./repro<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.611428][ T7970] BTRFS info (device loop0): fs_info exclusive_operation: 0<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.613973][ T7971] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.615456][ T7972] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.617528][ T7973] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.618359][ T7974] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.622589][ T7975] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.624034][ T7976] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.626420][ T7977] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.627643][ T7978] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Failed to add device /dev/vda, errno 14<br /> [ 416.629006][ T7979] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> [ 416.630298][ T7980] BTRFS info (device loop0): fs_info exclusive_operation: 3<br /> Fai<br /> ---truncated---