CVE-2023-53339

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix BUGON condition in btrfscancel_balance

Pausing and canceling balance can race to interrupt balance lead to BUGON panic in btrfscancelbalance. The BUGON condition in btrfscancelbalance does not take this race scenario into account.

However, the race condition has no other side effects. We can fix that.

Reproducing it with panic trace like this:

kernel BUG at fs/btrfs/volumes.c:4618! RIP: 0010:btrfscancelbalance+0x5cf/0x6a0 Call Trace: <TASK> ? donanosleep+0x60/0x120 ? hrtimernanosleep+0xb7/0x1a0 ? schedcoreclonecookie+0x70/0x70 btrfsioctlbalancectl+0x55/0x70 btrfsioctl+0xa46/0xd20 _x64sysioctl+0x7d/0xa0 dosyscall64+0x38/0x80 entrySYSCALL64afterhwframe+0x63/0xcd

Race scenario as follows:

mutexunlock(&fsinfo->balance_mutex);

.......issue pause and cancel req in another thread

ret = _btrfsbalance(fs_info);

mutexlock(&fsinfo->balancemutex); if (ret == -ECANCELED && atomicread(&fsinfo->balancepausereq)) { btrfsinfo(fsinfo, "balance: paused"); btrfsexclopbalance(fsinfo, BTRFSEXCLOPBALANCE_PAUSED); }