CVE-2023-54224

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix lockdep splat and potential deadlock after failure running delayed items<br /> <br /> When running delayed items we are holding a delayed node&amp;#39;s mutex and then<br /> we will attempt to modify a subvolume btree to insert/update/delete the<br /> delayed items. However if have an error during the insertions for example,<br /> btrfs_insert_delayed_items() may return with a path that has locked extent<br /> buffers (a leaf at the very least), and then we attempt to release the<br /> delayed node at __btrfs_run_delayed_items(), which requires taking the<br /> delayed node&amp;#39;s mutex, causing an ABBA type of deadlock. This was reported<br /> by syzbot and the lockdep splat is the following:<br /> <br /> WARNING: possible circular locking dependency detected<br /> 6.5.0-rc7-syzkaller-00024-g93f5de5f648d #0 Not tainted<br /> ------------------------------------------------------<br /> syz-executor.2/13257 is trying to acquire lock:<br /> ffff88801835c0c0 (&amp;delayed_node-&gt;mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256<br /> <br /> but task is already holding lock:<br /> ffff88802a5ab8e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_lock+0x3c/0x2a0 fs/btrfs/locking.c:198<br /> <br /> which lock already depends on the new lock.<br /> <br /> the existing dependency chain (in reverse order) is:<br /> <br /> -&gt; #1 (btrfs-tree-00){++++}-{3:3}:<br /> __lock_release kernel/locking/lockdep.c:5475 [inline]<br /> lock_release+0x36f/0x9d0 kernel/locking/lockdep.c:5781<br /> up_write+0x79/0x580 kernel/locking/rwsem.c:1625<br /> btrfs_tree_unlock_rw fs/btrfs/locking.h:189 [inline]<br /> btrfs_unlock_up_safe+0x179/0x3b0 fs/btrfs/locking.c:239<br /> search_leaf fs/btrfs/ctree.c:1986 [inline]<br /> btrfs_search_slot+0x2511/0x2f80 fs/btrfs/ctree.c:2230<br /> btrfs_insert_empty_items+0x9c/0x180 fs/btrfs/ctree.c:4376<br /> btrfs_insert_delayed_item fs/btrfs/delayed-inode.c:746 [inline]<br /> btrfs_insert_delayed_items fs/btrfs/delayed-inode.c:824 [inline]<br /> __btrfs_commit_inode_delayed_items+0xd24/0x2410 fs/btrfs/delayed-inode.c:1111<br /> __btrfs_run_delayed_items+0x1db/0x430 fs/btrfs/delayed-inode.c:1153<br /> flush_space+0x269/0xe70 fs/btrfs/space-info.c:723<br /> btrfs_async_reclaim_metadata_space+0x106/0x350 fs/btrfs/space-info.c:1078<br /> process_one_work+0x92c/0x12c0 kernel/workqueue.c:2600<br /> worker_thread+0xa63/0x1210 kernel/workqueue.c:2751<br /> kthread+0x2b8/0x350 kernel/kthread.c:389<br /> ret_from_fork+0x2e/0x60 arch/x86/kernel/process.c:145<br /> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304<br /> <br /> -&gt; #0 (&amp;delayed_node-&gt;mutex){+.+.}-{3:3}:<br /> check_prev_add kernel/locking/lockdep.c:3142 [inline]<br /> check_prevs_add kernel/locking/lockdep.c:3261 [inline]<br /> validate_chain kernel/locking/lockdep.c:3876 [inline]<br /> __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144<br /> lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761<br /> __mutex_lock_common+0x1d8/0x2530 kernel/locking/mutex.c:603<br /> __mutex_lock kernel/locking/mutex.c:747 [inline]<br /> mutex_lock_nested+0x1b/0x20 kernel/locking/mutex.c:799<br /> __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256<br /> btrfs_release_delayed_node fs/btrfs/delayed-inode.c:281 [inline]<br /> __btrfs_run_delayed_items+0x2b5/0x430 fs/btrfs/delayed-inode.c:1156<br /> btrfs_commit_transaction+0x859/0x2ff0 fs/btrfs/transaction.c:2276<br /> btrfs_sync_file+0xf56/0x1330 fs/btrfs/file.c:1988<br /> vfs_fsync_range fs/sync.c:188 [inline]<br /> vfs_fsync fs/sync.c:202 [inline]<br /> do_fsync fs/sync.c:212 [inline]<br /> __do_sys_fsync fs/sync.c:220 [inline]<br /> __se_sys_fsync fs/sync.c:218 [inline]<br /> __x64_sys_fsync+0x196/0x1e0 fs/sync.c:218<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> other info that<br /> ---truncated---