CVE-2023-53348 (GCVE-0-2023-53348)
Vulnerability from cvelistv5
Published
2025-09-17 14:56
Modified
2025-09-17 14:56
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock when aborting transaction during relocation with scrub Before relocating a block group we pause scrub, then do the relocation and then unpause scrub. The relocation process requires starting and committing a transaction, and if we have a failure in the critical section of the transaction commit path (transaction state >= TRANS_STATE_COMMIT_START), we will deadlock if there is a paused scrub. That results in stack traces like the following: [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6 [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction. [42.936] ------------[ cut here ]------------ [42.936] BTRFS: Transaction aborted (error -28) [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...) [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] [42.936] Code: ff ff 45 8b (...) [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282 [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000 [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8 [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00 [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0 [42.936] FS: 00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000 [42.936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0 [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [42.936] Call Trace: [42.936] <TASK> [42.936] ? start_transaction+0xcb/0x610 [btrfs] [42.936] prepare_to_relocate+0x111/0x1a0 [btrfs] [42.936] relocate_block_group+0x57/0x5d0 [btrfs] [42.936] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs] [42.936] btrfs_relocate_block_group+0x248/0x3c0 [btrfs] [42.936] ? __pfx_autoremove_wake_function+0x10/0x10 [42.936] btrfs_relocate_chunk+0x3b/0x150 [btrfs] [42.936] btrfs_balance+0x8ff/0x11d0 [btrfs] [42.936] ? __kmem_cache_alloc_node+0x14a/0x410 [42.936] btrfs_ioctl+0x2334/0x32c0 [btrfs] [42.937] ? mod_objcg_state+0xd2/0x360 [42.937] ? refill_obj_stock+0xb0/0x160 [42.937] ? seq_release+0x25/0x30 [42.937] ? __rseq_handle_notify_resume+0x3b5/0x4b0 [42.937] ? percpu_counter_add_batch+0x2e/0xa0 [42.937] ? __x64_sys_ioctl+0x88/0xc0 [42.937] __x64_sys_ioctl+0x88/0xc0 [42.937] do_syscall_64+0x38/0x90 [42.937] entry_SYSCALL_64_after_hwframe+0x72/0xdc [42.937] RIP: 0033:0x7f381a6ffe9b [42.937] Code: 00 48 89 44 24 (...) [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003 [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000 [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423 [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148 [42.937] </TASK> [42.937] ---[ end trace 0000000000000000 ]--- [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds. [59.196] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.196] "echo 0 > /proc/sys/kernel/hung_ ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 55e3a601c81cdca4497bf855fa4d331f8e830744
Version: 55e3a601c81cdca4497bf855fa4d331f8e830744
Version: 55e3a601c81cdca4497bf855fa4d331f8e830744
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/transaction.c",
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6134a4bb6b1c411a244edee041ac89266c78d45c",
              "status": "affected",
              "version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
              "versionType": "git"
            },
            {
              "lessThan": "10a5831b193390b77705fc174a309476c23ba64a",
              "status": "affected",
              "version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
              "versionType": "git"
            },
            {
              "lessThan": "2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c",
              "status": "affected",
              "version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/transaction.c",
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock when aborting transaction during relocation with scrub\n\nBefore relocating a block group we pause scrub, then do the relocation and\nthen unpause scrub. The relocation process requires starting and committing\na transaction, and if we have a failure in the critical section of the\ntransaction commit path (transaction state \u003e= TRANS_STATE_COMMIT_START),\nwe will deadlock if there is a paused scrub.\n\nThat results in stack traces like the following:\n\n  [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6\n  [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction.\n  [42.936] ------------[ cut here ]------------\n  [42.936] BTRFS: Transaction aborted (error -28)\n  [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n  [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...)\n  [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\n  [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n  [42.936] Code: ff ff 45 8b (...)\n  [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282\n  [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000\n  [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff\n  [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8\n  [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00\n  [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0\n  [42.936] FS:  00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000\n  [42.936] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0\n  [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [42.936] Call Trace:\n  [42.936]  \u003cTASK\u003e\n  [42.936]  ? start_transaction+0xcb/0x610 [btrfs]\n  [42.936]  prepare_to_relocate+0x111/0x1a0 [btrfs]\n  [42.936]  relocate_block_group+0x57/0x5d0 [btrfs]\n  [42.936]  ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs]\n  [42.936]  btrfs_relocate_block_group+0x248/0x3c0 [btrfs]\n  [42.936]  ? __pfx_autoremove_wake_function+0x10/0x10\n  [42.936]  btrfs_relocate_chunk+0x3b/0x150 [btrfs]\n  [42.936]  btrfs_balance+0x8ff/0x11d0 [btrfs]\n  [42.936]  ? __kmem_cache_alloc_node+0x14a/0x410\n  [42.936]  btrfs_ioctl+0x2334/0x32c0 [btrfs]\n  [42.937]  ? mod_objcg_state+0xd2/0x360\n  [42.937]  ? refill_obj_stock+0xb0/0x160\n  [42.937]  ? seq_release+0x25/0x30\n  [42.937]  ? __rseq_handle_notify_resume+0x3b5/0x4b0\n  [42.937]  ? percpu_counter_add_batch+0x2e/0xa0\n  [42.937]  ? __x64_sys_ioctl+0x88/0xc0\n  [42.937]  __x64_sys_ioctl+0x88/0xc0\n  [42.937]  do_syscall_64+0x38/0x90\n  [42.937]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n  [42.937] RIP: 0033:0x7f381a6ffe9b\n  [42.937] Code: 00 48 89 44 24 (...)\n  [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b\n  [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003\n  [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000\n  [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423\n  [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148\n  [42.937]  \u003c/TASK\u003e\n  [42.937] ---[ end trace 0000000000000000 ]---\n  [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left\n  [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds.\n  [59.196]       Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\n  [59.196] \"echo 0 \u003e /proc/sys/kernel/hung_\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T14:56:39.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6134a4bb6b1c411a244edee041ac89266c78d45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/10a5831b193390b77705fc174a309476c23ba64a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c"
        }
      ],
      "title": "btrfs: fix deadlock when aborting transaction during relocation with scrub",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53348",
    "datePublished": "2025-09-17T14:56:39.800Z",
    "dateReserved": "2025-09-16T16:08:59.566Z",
    "dateUpdated": "2025-09-17T14:56:39.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53348\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-17T15:15:38.727\",\"lastModified\":\"2025-09-18T13:43:34.310\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix deadlock when aborting transaction during relocation with scrub\\n\\nBefore relocating a block group we pause scrub, then do the relocation and\\nthen unpause scrub. The relocation process requires starting and committing\\na transaction, and if we have a failure in the critical section of the\\ntransaction commit path (transaction state \u003e= TRANS_STATE_COMMIT_START),\\nwe will deadlock if there is a paused scrub.\\n\\nThat results in stack traces like the following:\\n\\n  [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6\\n  [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction.\\n  [42.936] ------------[ cut here ]------------\\n  [42.936] BTRFS: Transaction aborted (error -28)\\n  [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\\n  [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...)\\n  [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\\n  [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\\n  [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\\n  [42.936] Code: ff ff 45 8b (...)\\n  [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282\\n  [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000\\n  [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff\\n  [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8\\n  [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00\\n  [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0\\n  [42.936] FS:  00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000\\n  [42.936] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0\\n  [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  [42.936] Call Trace:\\n  [42.936]  \u003cTASK\u003e\\n  [42.936]  ? start_transaction+0xcb/0x610 [btrfs]\\n  [42.936]  prepare_to_relocate+0x111/0x1a0 [btrfs]\\n  [42.936]  relocate_block_group+0x57/0x5d0 [btrfs]\\n  [42.936]  ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs]\\n  [42.936]  btrfs_relocate_block_group+0x248/0x3c0 [btrfs]\\n  [42.936]  ? __pfx_autoremove_wake_function+0x10/0x10\\n  [42.936]  btrfs_relocate_chunk+0x3b/0x150 [btrfs]\\n  [42.936]  btrfs_balance+0x8ff/0x11d0 [btrfs]\\n  [42.936]  ? __kmem_cache_alloc_node+0x14a/0x410\\n  [42.936]  btrfs_ioctl+0x2334/0x32c0 [btrfs]\\n  [42.937]  ? mod_objcg_state+0xd2/0x360\\n  [42.937]  ? refill_obj_stock+0xb0/0x160\\n  [42.937]  ? seq_release+0x25/0x30\\n  [42.937]  ? __rseq_handle_notify_resume+0x3b5/0x4b0\\n  [42.937]  ? percpu_counter_add_batch+0x2e/0xa0\\n  [42.937]  ? __x64_sys_ioctl+0x88/0xc0\\n  [42.937]  __x64_sys_ioctl+0x88/0xc0\\n  [42.937]  do_syscall_64+0x38/0x90\\n  [42.937]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n  [42.937] RIP: 0033:0x7f381a6ffe9b\\n  [42.937] Code: 00 48 89 44 24 (...)\\n  [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\\n  [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b\\n  [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003\\n  [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000\\n  [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423\\n  [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148\\n  [42.937]  \u003c/TASK\u003e\\n  [42.937] ---[ end trace 0000000000000000 ]---\\n  [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left\\n  [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds.\\n  [59.196]       Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\\n  [59.196] \\\"echo 0 \u003e /proc/sys/kernel/hung_\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10a5831b193390b77705fc174a309476c23ba64a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6134a4bb6b1c411a244edee041ac89266c78d45c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.