CVE-2022-50379
18.09.2025, 14:15
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else. We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker. So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 𝑥 < 4.19.262 |
| linux | linux_kernel | 4.20 ≤ 𝑥 < 5.4.220 |
| linux | linux_kernel | 5.5 ≤ 𝑥 < 5.10.150 |
| linux | linux_kernel | 5.11 ≤ 𝑥 < 5.15.75 |
| linux | linux_kernel | 5.16 ≤ 𝑥 < 5.19.17 |
| linux | linux_kernel | 6.0 ≤ 𝑥 < 6.0.3 |
𝑥
= Vulnerable software versions
Debian Releases
References