cve-2023-52737
Vulnerability from cvelistv5
Published
2024-05-21 15:23
Modified
2024-11-04 14:51
Severity ?
Summary
btrfs: lock the inode in shared mode before starting fiemap
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/519b7e13b5ae8dd38da1e52275705343be6bb508
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d8c594da79bc0244e610a70594e824a401802be1
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.060Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d8c594da79bc0244e610a70594e824a401802be1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/519b7e13b5ae8dd38da1e52275705343be6bb508"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:37:35.005166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:35.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8c594da79bc",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "519b7e13b5ae",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lock the inode in shared mode before starting fiemap\n\nCurrently fiemap does not take the inode\u0027s lock (VFS lock), it only locks\na file range in the inode\u0027s io tree. This however can lead to a deadlock\nif we have a concurrent fsync on the file and fiemap code triggers a fault\nwhen accessing the user space buffer with fiemap_fill_next_extent(). The\ndeadlock happens on the inode\u0027s i_mmap_lock semaphore, which is taken both\nby fsync and btrfs_page_mkwrite(). This deadlock was recently reported by\nsyzbot and triggers a trace like the following:\n\n   task:syz-executor361 state:D stack:20264 pid:5668  ppid:5119   flags:0x00004004\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    wait_on_state fs/btrfs/extent-io-tree.c:707 [inline]\n    wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751\n    lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742\n    find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488\n    writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863\n    __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174\n    extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091\n    extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211\n    do_writepages+0x3c3/0x680 mm/page-writeback.c:2581\n    filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388\n    __filemap_fdatawrite_range mm/filemap.c:421 [inline]\n    filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439\n    btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline]\n    start_ordered_ops fs/btrfs/file.c:1737 [inline]\n    btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839\n    generic_write_sync include/linux/fs.h:2885 [inline]\n    btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684\n    call_write_iter include/linux/fs.h:2189 [inline]\n    new_sync_write fs/read_write.c:491 [inline]\n    vfs_write+0x7dc/0xc50 fs/read_write.c:584\n    ksys_write+0x177/0x2a0 fs/read_write.c:637\n    do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\n   RIP: 0033:0x7f7d4054e9b9\n   RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n   RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9\n   RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006\n   RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000\n   R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69\n   R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8\n    \u003c/TASK\u003e\n   INFO: task syz-executor361:5697 blocked for more than 145 seconds.\n         Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0\n   \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n   task:syz-executor361 state:D stack:21216 pid:5697  ppid:5119   flags:0x00004004\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095\n    __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260\n    btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526\n    do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947\n    wp_page_shared+0x15e/0x380 mm/memory.c:3295\n    handle_pte_fault mm/memory.c:4949 [inline]\n    __handle_mm_fault mm/memory.c:5073 [inline]\n    handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219\n    do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428\n    handle_page_fault arch/x86/mm/fault.c:1519 [inline]\n    exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575\n    asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570\n   RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233\n   Code: 74 0a 89 (...)\n   RSP: 0018:ffffc9000570f330 EFLAGS: 000502\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T14:51:43.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d8c594da79bc0244e610a70594e824a401802be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/519b7e13b5ae8dd38da1e52275705343be6bb508"
        }
      ],
      "title": "btrfs: lock the inode in shared mode before starting fiemap",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52737",
    "datePublished": "2024-05-21T15:23:01.202Z",
    "dateReserved": "2024-05-21T15:19:24.233Z",
    "dateUpdated": "2024-11-04T14:51:43.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52737\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:13.667\",\"lastModified\":\"2024-05-21T16:53:56.550\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: lock the inode in shared mode before starting fiemap\\n\\nCurrently fiemap does not take the inode\u0027s lock (VFS lock), it only locks\\na file range in the inode\u0027s io tree. This however can lead to a deadlock\\nif we have a concurrent fsync on the file and fiemap code triggers a fault\\nwhen accessing the user space buffer with fiemap_fill_next_extent(). The\\ndeadlock happens on the inode\u0027s i_mmap_lock semaphore, which is taken both\\nby fsync and btrfs_page_mkwrite(). This deadlock was recently reported by\\nsyzbot and triggers a trace like the following:\\n\\n   task:syz-executor361 state:D stack:20264 pid:5668  ppid:5119   flags:0x00004004\\n   Call Trace:\\n    \u003cTASK\u003e\\n    context_switch kernel/sched/core.c:5293 [inline]\\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\\n    wait_on_state fs/btrfs/extent-io-tree.c:707 [inline]\\n    wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751\\n    lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742\\n    find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488\\n    writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863\\n    __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174\\n    extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091\\n    extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211\\n    do_writepages+0x3c3/0x680 mm/page-writeback.c:2581\\n    filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388\\n    __filemap_fdatawrite_range mm/filemap.c:421 [inline]\\n    filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439\\n    btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline]\\n    start_ordered_ops fs/btrfs/file.c:1737 [inline]\\n    btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839\\n    generic_write_sync include/linux/fs.h:2885 [inline]\\n    btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684\\n    call_write_iter include/linux/fs.h:2189 [inline]\\n    new_sync_write fs/read_write.c:491 [inline]\\n    vfs_write+0x7dc/0xc50 fs/read_write.c:584\\n    ksys_write+0x177/0x2a0 fs/read_write.c:637\\n    do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n   RIP: 0033:0x7f7d4054e9b9\\n   RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\\n   RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9\\n   RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006\\n   RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000\\n   R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69\\n   R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8\\n    \u003c/TASK\u003e\\n   INFO: task syz-executor361:5697 blocked for more than 145 seconds.\\n         Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0\\n   \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n   task:syz-executor361 state:D stack:21216 pid:5697  ppid:5119   flags:0x00004004\\n   Call Trace:\\n    \u003cTASK\u003e\\n    context_switch kernel/sched/core.c:5293 [inline]\\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\\n    rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095\\n    __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260\\n    btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526\\n    do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947\\n    wp_page_shared+0x15e/0x380 mm/memory.c:3295\\n    handle_pte_fault mm/memory.c:4949 [inline]\\n    __handle_mm_fault mm/memory.c:5073 [inline]\\n    handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219\\n    do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428\\n    handle_page_fault arch/x86/mm/fault.c:1519 [inline]\\n    exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575\\n    asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570\\n   RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233\\n   Code: 74 0a 89 (...)\\n   RSP: 0018:ffffc9000570f330 EFLAGS: 000502\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: bloquea el inodo en modo compartido antes de iniciar fiemap. Actualmente, fiemap no toma el bloqueo del inodo (bloqueo VFS), solo bloquea un rango de archivos en el \u00e1rbol io del inodo. Sin embargo, esto puede llevar a un punto muerto si tenemos un fsync simult\u00e1neo en el archivo y el c\u00f3digo fiemap desencadena una falla al acceder al b\u00fafer de espacio de usuario con fiemap_fill_next_extent(). El punto muerto ocurre en el sem\u00e1foro i_mmap_lock del inodo, que es tomado tanto por fsync como por btrfs_page_mkwrite(). Syzbot inform\u00f3 recientemente de este punto muerto y activa un seguimiento como el siguiente: task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004 Call Trace:  context_switch kernel/sched/core.c: 5293 [en l\u00ednea] __schedule+0x995/0xe20 kernel/sched/core.c:6606 Schedule+0xcb/0x190 kernel/sched/core.c:6682 wait_on_state fs/btrfs/extent-io-tree.c:707 [en l\u00ednea] wait_extent_bit +0x577/0x6f0 fs/btrfs/extent-io-tree.c:751 lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742 find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488 writepage_delalloc +0x1ef/0x540 fs/btrfs/extent_io.c:1863 __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174 extensi\u00f3n_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091 extensi\u00f3n_writepages+0x219/0 x540 fs/btrfs/ extend_io.c:3211 do_writepages+0x3c3/0x680 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [en l\u00ednea] filemap_fdatawrite_range+0x175/0x200 mm/filemap .c:439 btrfs_fdatawrite_range fs/btrfs/file.c:3850 [en l\u00ednea] start_ordered_ops fs/btrfs/file.c:1737 [en l\u00ednea] btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839 generic_write_sync include/linux/fs .h:2885 [en l\u00ednea] btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684 call_write_iter include/linux/fs.h:2189 [en l\u00ednea] new_sync_write fs/read_write.c:491 [en l\u00ednea] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [en l\u00ednea] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: fffffffffffffda 00007f7d405d87a0 RCX: 00007f7d4054e9b9 RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007f7d405a51d0 R08: 000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8  INFORMACI\u00d3N: tarea syz-executor361:5697 bloqueada durante m\u00e1s de 145 segundos. No contaminado 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0 \\\"echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\\\" desactiva este mensaje. tarea:syz-executor361 estado:D pila:21216 pid:5697 ppid:5119 banderas:0x00004004 Seguimiento de llamadas:  context_switch kernel/sched/core.c:5293 [en l\u00ednea] __schedule+0x995/0xe20 kernel/sched/core. c:6606 Schedule+0xcb/0x190 kernel/sched/core.c:6682 rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095 __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260 btrfs_page_mkwrite+0x417/ 0xc80 fs/btrfs/inode.c:8526 do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947 wp_page_shared+0x15e/0x380 mm/memory.c:3295 handle_pte_fault mm/memory.c:4949 [en l\u00ednea] __handle_mm_fault mm/memory.c :5073 [en l\u00ednea] handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219 do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [en l\u00ednea] exc_page_fault+ 0x7a/0x110 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S :233 C\u00f3digo: 74 0a 89 (...) RSP: 0018:ffffc9000570f330 EFLAGS: 000502 ---truncado---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/519b7e13b5ae8dd38da1e52275705343be6bb508\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d8c594da79bc0244e610a70594e824a401802be1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.