CVE-2023-54080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: skip splitting and logical rewriting on pre-alloc write

When doing a relocation, there is a chance that at the time of

btrfs_reloc_clone_csums(), there is no checksum for the corresponding

region.

In this case, btrfs_finish_ordered_zoned()'s sum points to an invalid item

and so ordered_extent's logical is set to some invalid value. Then,

btrfs_lookup_block_group() in btrfs_zone_finish_endio() failed to find a

block group and will hit an assert or a null pointer dereference as

following.

This can be reprodcued by running btrfs/028 several times (e.g, 4 to 16

times) with a null_blk setup. The device's zone size and capacity is set to

32 MB and the storage size is set to 5 GB on my setup.

KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]

CPU: 6 PID: 3105720 Comm: kworker/u16:13 Tainted: G W 6.5.0-rc6-kts+ #1

Hardware name: Supermicro Super Server/X10SRL-F

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References