Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as they are in transaction error paths and situations where the block group is readonly. However, if there is any chance at all of racing with mark_bg_unused(), or a different future user of bg_list, better to be safe than sorry. Otherwise we risk the following interleaving (bg_list refcount in parens) T1 (some random op) T2 (btrfs_mark_bg_unused) !list_empty(&bg->bg_list); (1) list_del_init(&bg->bg_list); (1) list_move_tail (1) btrfs_put_block_group (0) btrfs_delete_unused_bgs bg = list_first_entry list_del_init(&bg->bg_list); btrfs_put_block_group(bg); (-1) Ultimately, this results in a broken ref count that hits zero one deref early and the real final deref underflows the refcount, resulting in a WARNING.
Product status
a9f189716cf15913c453299d72f69c51a9b0f86b (git) before bf089c4d1141b27332c092b1dcca5022c415a3b6
a9f189716cf15913c453299d72f69c51a9b0f86b (git) before 909e60fb469d4101c6b08cf6e622efb062bb24a1
a9f189716cf15913c453299d72f69c51a9b0f86b (git) before 185fd73e5ac06027c4be9a129e59193f6a3ef202
a9f189716cf15913c453299d72f69c51a9b0f86b (git) before 7511e29cf1355b2c47d0effb39e463119913e2f6
edf3b5aadb2515c808200b904baa5b70a727f0ac (git)
01eca70ef8cf499d0cb6d1bbd691558e7792cf17 (git)
5d19abcffd8404078dfa7d7118cec357b5e7bc58 (git)
6.5
Any version before 6.5
6.12.24 (semver)
6.13.12 (semver)
6.14.3 (semver)
6.15 (original_commit_for_fix)
References
git.kernel.org/...c/bf089c4d1141b27332c092b1dcca5022c415a3b6
git.kernel.org/...c/909e60fb469d4101c6b08cf6e622efb062bb24a1
git.kernel.org/...c/185fd73e5ac06027c4be9a129e59193f6a3ef202
git.kernel.org/...c/7511e29cf1355b2c47d0effb39e463119913e2f6