In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between quota enable and quota rescan ioctl
When enabling quotas, at btrfsquotaenable(), after committing the transaction, we change fsinfo->quotaroot to point to the quota root we created and set BTRFSFSQUOTAENABLED at fsinfo->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgrouprescaninit() - however if that fails we end up freeing the quota root but we leave fsinfo->quotaroot still pointing to it, this can later result in a use-after-free somewhere else.
We have previously set the flags BTRFSFSQUOTAENABLED and BTRFSQGROUPSTATUSFLAGON, so we can only fail with -EINPROGRESS at btrfsquota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker.
So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50379.json",
"cna_assigner": "Linux"
}