CVE-2023-53339

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix BUG_ON condition in btrfs_cancel_balance<br /> <br /> Pausing and canceling balance can race to interrupt balance lead to BUG_ON<br /> panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance<br /> does not take this race scenario into account.<br /> <br /> However, the race condition has no other side effects. We can fix that.<br /> <br /> Reproducing it with panic trace like this:<br /> <br /> kernel BUG at fs/btrfs/volumes.c:4618!<br /> RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0<br /> Call Trace:<br /> <br /> ? do_nanosleep+0x60/0x120<br /> ? hrtimer_nanosleep+0xb7/0x1a0<br /> ? sched_core_clone_cookie+0x70/0x70<br /> btrfs_ioctl_balance_ctl+0x55/0x70<br /> btrfs_ioctl+0xa46/0xd20<br /> __x64_sys_ioctl+0x7d/0xa0<br /> do_syscall_64+0x38/0x80<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Race scenario as follows:<br /> &gt; mutex_unlock(&amp;fs_info-&gt;balance_mutex);<br /> &gt; --------------------<br /> &gt; .......issue pause and cancel req in another thread<br /> &gt; --------------------<br /> &gt; ret = __btrfs_balance(fs_info);<br /> &gt;<br /> &gt; mutex_lock(&amp;fs_info-&gt;balance_mutex);<br /> &gt; if (ret == -ECANCELED &amp;&amp; atomic_read(&amp;fs_info-&gt;balance_pause_req)) {<br /> &gt; btrfs_info(fs_info, "balance: paused");<br /> &gt; btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);<br /> &gt; }