Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6c387ab20db15f2bd448f7c508e2638101b16ea1 to < e7e1d15d2bd8c373cf621614ddd17971a2132713affected6c387ab20db15f2bd448f7c508e2638101b16ea1 to < 7170875083254b51fcc5d67f96640977083f481eaffected6c387ab20db15f2bd448f7c508e2638101b16ea1 to < e76c78c48902dae6fa612749f59162bca0a79e0baffected6c387ab20db15f2bd448f7c508e2638101b16ea1 to < d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14affected6c387ab20db15f2bd448f7c508e2638101b16ea1 to < 8cbc3001a3264d998d6b6db3e23f935c158abd4daffected
Linux Linux
Default version status: affected
3.18affected0 to < 3.18unaffected5.10.248 to ≤ 5.10.*unaffected5.15.184 to ≤ 5.15.*unaffected5.16.19 to ≤ 5.16.*unaffected5.17.2 to ≤ 5.17.*unaffected5.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e7e1d15d2bd8c373cf621614ddd17971a2132713 ↗
- https://git.kernel.org/stable/c/7170875083254b51fcc5d67f96640977083f481e ↗
- https://git.kernel.org/stable/c/e76c78c48902dae6fa612749f59162bca0a79e0b ↗
- https://git.kernel.org/stable/c/d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14 ↗
- https://git.kernel.org/stable/c/8cbc3001a3264d998d6b6db3e23f935c158abd4d ↗