AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416

OR
          *cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.63
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 5.19.4
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.184
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.247
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.286
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.14.318

kernel.org: https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719 Types: Patch

kernel.org: https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e Types: Patch

kernel.org: https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb Types: Patch

kernel.org: https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37 Types: Patch

kernel.org: https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1 Types: Patch

kernel.org: https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f Types: Patch

kernel.org: https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()

In btrfs_relocate_block_group(), the rc is allocated.  Then
btrfs_relocate_block_group() calls

relocate_block_group()
  prepare_to_relocate()
    set_reloc_control()

that assigns rc to the variable fs_info->reloc_ctl. When
prepare_to_relocate() returns, it calls

btrfs_commit_transaction()
  btrfs_start_dirty_block_groups()
    btrfs_alloc_path()
      kmem_cache_zalloc()

which may fail for example (or other errors could happen). When the
failure occurs, btrfs_relocate_block_group() detects the error and frees
rc and doesn't set fs_info->reloc_ctl to NULL. After that, in
btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and
then used, which may cause a use-after-free bug.

This possible bug can be triggered by calling btrfs_ioctl_balance()
before calling btrfs_ioctl_defrag().

To fix this possible bug, in prepare_to_relocate(), check if
btrfs_commit_transaction() fails. If the failure occurs,
unset_reloc_control() is called to set fs_info->reloc_ctl to NULL.

The error log in our fault-injection testing is shown as follows:

  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
  ...
  [   58.753577] Call Trace:
  ...
  [   58.755800]  kasan_report+0x45/0x60
  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]
  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]
  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]
  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]
  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]
  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]
  ...
  [   58.768510] Allocated by task 23683:
  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0
  [   58.769069]  __kmalloc+0x227/0x3d0
  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]
  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]
  [

https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719

https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e

https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb

https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37

https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1

https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f

https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b