CVE-2025-37856
btrfs: harden block_group::bg_list against list_del() races
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
btrfs: harden block_group::bg_list against list_del() races
In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as they are in transaction error paths and situations where the block group is readonly. However, if there is any chance at all of racing with mark_bg_unused(), or a different future user of bg_list, better to be safe than sorry. Otherwise we risk the following interleaving (bg_list refcount in parens) T1 (some random op) T2 (btrfs_mark_bg_unused) !list_empty(&bg->bg_list); (1) list_del_init(&bg->bg_list); (1) list_move_tail (1) btrfs_put_block_group (0) btrfs_delete_unused_bgs bg = list_first_entry list_del_init(&bg->bg_list); btrfs_put_block_group(bg); (-1) Ultimately, this results in a broken ref count that hits zero one deref early and the real final deref underflows the refcount, resulting in a WARNING.
Reserved 2025-04-16 | Published 2025-05-09 | Updated 2025-05-09 | Assigner Linuxgit.kernel.org/...c/bf089c4d1141b27332c092b1dcca5022c415a3b6
git.kernel.org/...c/909e60fb469d4101c6b08cf6e622efb062bb24a1
git.kernel.org/...c/185fd73e5ac06027c4be9a129e59193f6a3ef202
git.kernel.org/...c/7511e29cf1355b2c47d0effb39e463119913e2f6
Support options
