CVE-2021-47599

btrfs: use latest_dev in btrfs_show_devname

published June 19, 2024

CVSS
—
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: use latest_dev in btrfs_show_devname

The test case btrfs/238 reports the warning below:

WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs]

CPU: 2 PID: 1 Comm: systemd Tainted: G W O 5.14.0-rc1-custom #72

Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015

Call trace:

btrfs_show_devname+0x108/0x1b4 [btrfs]

show_mountinfo+0x234/0x2c4

m_show+0x28/0x34

seq_read_iter+0x12c/0x3c4

vfs_read+0x29c/0x2c8

ksys_read+0x80/0xec

__arm64_sys_read+0x28/0x34

invoke_syscall+0x50/0xf8

do_el0_svc+0x88/0x138

el0_svc+0x2c/0x8c

el0t_64_sync_handler+0x84/0xe4

el0t_64_sync+0x198/0x19c

Reason:

While btrfs_prepare_sprout() moves the fs_devices::devices into

fs_devices::seed_list, the btrfs_show_devname() searches for the devices

and found none, leading to the warning as in above.

Fix:

latest_dev is updated according to the changes to the device list.

That means we could use the latest_dev->name to show the device name in

/proc/self/mounts, the pointer will be always valid as it's assigned

before the device is deleted from the list in remove or replace.

The RCU protection is sufficient as the device structure is freed after

synchronization.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Published
2024-06-19T14:54Z
EPSS history
Timeline
  • 19 JUN 14:54Z
    btrfs: use latest_dev in btrfs_show_devname
    cvelistv5