CVE: CVE-2023-54067
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race when deleting free space root from the dirty cow roots list

When deleting the free space tree we are deleting the free space root
from the list fs_info->dirty_cowonly_roots without taking the lock that
protects it, which is struct btrfs_fs_info::trans_lock.
This unsynchronized list manipulation may cause chaos if there's another
concurrent manipulation of this list, such as when adding a root to it
with ctree.c:add_root_to_dirty_list().

This can result in all sorts of weird failures caused by a race, such as
the following crash:

  [[PII_REDACTED]45] general protection fault, probably for non-canonical address 0xdead[PII_REDACTED]08: 0000 [#1] PREEMPT SMP PTI
  [[PII_REDACTED]33] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [[PII_REDACTED]53] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
  [[PII_REDACTED]72] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
  [[PII_REDACTED]28] Code: 85 38 06 00 (...)
  [[PII_REDACTED]63] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
  [[PII_REDACTED]82] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX:[PII_REDACTED]e1c000
  [[PII_REDACTED]98] RDX: dead[PII_REDACTED]00 RSI: ffff9430021e4900 RDI: [PII_REDACTED]
  [[PII_REDACTED]15] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09:[PII_REDACTED]00015b
  [[PII_REDACTED]54] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff942fe8fbf600
  [[PII_REDACTED]76] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
  [[PII_REDACTED]23] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:[PII_REDACTED]
  [[PII_REDACTED]50] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  [[PII_REDACTED]84] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4:[PII_REDACTED]370ee0
  [[PII_REDACTED]16] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
  [[PII_REDACTED]47] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
  [[PII_REDACTED]74] Call Trace:
  [[PII_REDACTED]01]  <TASK>
  [[PII_REDACTED]27]  ? __die_body+0x1b/0x60
  [[PII_REDACTED]70]  ? die_addr+0x39/0x60
  [[PII_REDACTED]96]  ? exc_general_protection+0x22e/0x430
  [[PII_REDACTED]22]  ? asm_exc_general_protection+0x22/0x30
  [[PII_REDACTED]51]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]
  [[PII_REDACTED]31]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]
  [[PII_REDACTED]03]  ? _raw_spin_unlock+0x15/0x30
  [[PII_REDACTED]31]  ? release_extent_buffer+0x103/0x130 [btrfs]
  [[PII_REDACTED]05]  reset_balance_state+0x152/0x1b0 [btrfs]
  [[PII_REDACTED]78]  btrfs_balance+0xa50/0x11e0 [btrfs]
  [[PII_REDACTED]64]  ? __kmem_cache_alloc_node+0x14a/0x410
  [[PII_REDACTED]86]  btrfs_ioctl+0x249a/0x3320 [btrfs]
  [[PII_REDACTED]58]  ? mod_objcg_state+0xd2/0x360
  [[PII_REDACTED]77]  ? refill_obj_stock+0xb0/0x160
  [[PII_REDACTED]98]  ? seq_release+0x25/0x30
  [[PII_REDACTED]16]  ? __rseq_handle_notify_resume+0x3ba/0x4b0
  [[PII_REDACTED]35]  ? percpu_counter_add_batch+0x2e/0xa0
  [[PII_REDACTED]55]  ? __x64_sys_ioctl+0x88/0xc0
  [[PII_REDACTED]75]  __x64_sys_ioctl+0x88/0xc0
  [[PII_REDACTED]01]  do_syscall_64+0x38/0x90
  [[PII_REDACTED]26]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
  [[PII_REDACTED]52] RIP: 0033:0x7f478aaffe9b

So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the free space root from that list.
References: https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892; https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443; https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879