linux-cve-announce - CVE-2022-50379: btrfs: fix race between quota enable and quota rescan ioctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091851-CVE-2022-50379-a7c6@gregkh>
Date: Thu, 18 Sep 2025 15:33:53 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50379: btrfs: fix race between quota enable and quota rescan ioctl

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between quota enable and quota rescan ioctl

When enabling quotas, at btrfs_quota_enable(), after committing the
transaction, we change fs_info->quota_root to point to the quota root we
created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try
to start the qgroup rescan worker, first by initializing it with a call
to qgroup_rescan_init() - however if that fails we end up freeing the
quota root but we leave fs_info->quota_root still pointing to it, this
can later result in a use-after-free somewhere else.

We have previously set the flags BTRFS_FS_QUOTA_ENABLED and
BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at
btrfs_quota_enable(), which is possible if someone already called the
quota rescan ioctl, and therefore started the rescan worker.

So fix this by ignoring an -EINPROGRESS and asserting we can't get any
other error.

The Linux kernel CVE team has assigned CVE-2022-50379 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.19.262 with commit c97f6d528c3f1c83a6b792a8a7928c236c80b8fe
	Fixed in 5.4.220 with commit 26b7c0ac49a3eea15559c9d84863736a6d1164b4
	Fixed in 5.10.150 with commit 47b5ffe86332af95f0f52be0a63d4da7c2b37b55
	Fixed in 5.15.75 with commit 4b996a3014ef014af8f97b60c35f5289210a4720
	Fixed in 5.19.17 with commit 0efd9dfc00d677a1d0929319a6103cb2dfc41c22
	Fixed in 6.0.3 with commit 6c22f86dd221eba0c7af645b1af73dcbc04ee27b
	Fixed in 6.1 with commit 331cd9461412e103d07595a10289de90004ac890

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50379
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/btrfs/qgroup.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c97f6d528c3f1c83a6b792a8a7928c236c80b8fe
	https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4
	https://git.kernel.org/stable/c/47b5ffe86332af95f0f52be0a63d4da7c2b37b55
	https://git.kernel.org/stable/c/4b996a3014ef014af8f97b60c35f5289210a4720
	https://git.kernel.org/stable/c/0efd9dfc00d677a1d0929319a6103cb2dfc41c22
	https://git.kernel.org/stable/c/6c22f86dd221eba0c7af645b1af73dcbc04ee27b
	https://git.kernel.org/stable/c/331cd9461412e103d07595a10289de90004ac890