CVE-2023-53339

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix BUG_ON condition in btrfs_cancel_balance

Pausing and canceling balance can race to interrupt balance lead to BUG_ON

panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance

does not take this race scenario into account.

However, the race condition has no other side effects. We can fix that.

Reproducing it with panic trace like this:

kernel BUG at fs/btrfs/volumes.c:4618!

RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0

Call Trace:

<TASK>

? do_nanosleep+0x60/0x120

? hrtimer_nanosleep+0xb7/0x1a0

? sched_core_clone_cookie+0x70/0x70

btrfs_ioctl_balance_ctl+0x55/0x70

btrfs_ioctl+0xa46/0xd20

__x64_sys_ioctl+0x7d/0xa0

do_syscall_64+0x38/0x80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

Race scenario as follows:

> mutex_unlock(&fs_info->balance_mutex);

> --------------------

> .......issue pause and cancel req in another thread

> --------------------

> ret

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References