CVE-2023-54121

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix incorrect splitting in btrfs_drop_extent_map_range

In production we were seeing a variety of WARN_ON()'s in the extent_map

code, specifically in btrfs_drop_extent_map_range() when we have to call

add_extent_mapping() for our second split.

Consider the following extent map layout

PINNED

[0 16K) [32K, 48K)

and then we call btrfs_drop_extent_map_range for [0, 36K), with

skip_pinned == true. The initial loop will have

start = 0

end = 36K

len = 36K

we will find the [0, 16k) extent, but since we are pinned we will skip

it, which has this code

start = em_end;

if (end != (u64)-1)

len = start + len - em_end;

em_end here is 16K, so now the values are

start = 16K

len = 16K + 36K - 16K = 36K

len should instead be 20K. This is a problem when we find the next

extent at [32K, 48K), we need to split this extent to leave [36K, 48k),

however the code for the split looks like this

split->start = star

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References