CVE-2022-50379

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between quota enable and quota rescan ioctl

When enabling quotas, at btrfs_quota_enable(), after committing the

transaction, we change fs_info->quota_root to point to the quota root we

created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try

to start the qgroup rescan worker, first by initializing it with a call

to qgroup_rescan_init() - however if that fails we end up freeing the

quota root but we leave fs_info->quota_root still pointing to it, this

can later result in a use-after-free somewhere else.

We have previously set the flags BTRFS_FS_QUOTA_ENABLED and

BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at

btrfs_quota_enable(), which is possible if someone already called the

quota rescan ioctl, and therefore started the rescan worker.

So fix this by ignoring an -EINPROGRESS and asserting we can't get any

other error.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References