CVE-2023-52897 — btrfs: qgroup: do not warn on record without old_roots populated

Back Back to CVE browser

MEDIUM

btrfs: qgroup: do not warn on record without old_roots populated

Published Aug 21, 2024

4.7

MEDIUM

CVSS 3.1

EPSS 0.20%

Description

[BUG] There are some reports from the mailing list that since v6.1 kernel, the WARN_ON() inside btrfs_qgroup_account_extent() gets triggered during rescan:

WARNING: CPU: 3 PID: 6424 at fs/btrfs/qgroup.c:2756 btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] CPU: 3 PID: 6424 Comm: snapperd Tainted: P OE 6.1.2-1-default #1 openSUSE Tumbleweed 05c7a1b1b61d5627475528f71f50444637b5aad7 RIP: 0010:btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] Call Trace: <TASK> btrfs_commit_transaction+0x30c/0xb40 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? start_transaction+0xc3/0x5b0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_qgroup_rescan+0x42/0xc0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_ioctl+0x1ab9/0x25c0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? __rseq_handle_notify_resume+0xa9/0x4a0 ? mntput_no_expire+0x4a/0x240 ? __seccomp_filter+0x319/0x4d0 __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x5b/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd9b790d9bf </TASK>

[CAUSE] Since commit e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), if our qgroup is already in inconsistent state, we will no longer do the time-consuming backref walk.

This can leave some qgroup records without a valid old_roots ulist. Normally this is fine, as btrfs_qgroup_account_extents() would also skip those records if we have NO_ACCOUNTING flag set.

But there is a small window, if we have NO_ACCOUNTING flag set, and inserted some qgroup_record without a old_roots ulist, but then the user triggered a qgroup rescan.

During btrfs_qgroup_rescan(), we firstly clear NO_ACCOUNTING flag, then commit current transaction.

And since we have a qgroup_record with old_roots = NULL, we trigger the WARN_ON() during btrfs_qgroup_account_extents().

[FIX] Unfortunately due to the introduction of NO_ACCOUNTING flag, the assumption that every qgroup_record would have its old_roots populated is no longer correct.

Fix the false alerts and drop the WARN_ON().

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.1
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.1
- Version
  6.1.8
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected

Linux

affected

Version	Status	Constraints
6.1	affected	-
0	unaffected	<6.1
6.1.8	unaffected	<=6.1.*
6.2	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat statement

Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux Kernel used in its distributions.

Red Hat mitigation

Mitigation for this issue is ei ther not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.20% 0.00198

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00198

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.20% (0.00198)	8.72th	v5 (v2026.06.15)
Jun 15, 2026	0.20% (0.00198)	9.68th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00039)	8.46th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00043)	10.81th	v3 (v2023.03.01)
Aug 22, 2024	0.04% (0.00043)	9.54th	v3 (v2023.03.01)

Weaknesses (1)

CWE-824

References (7)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-52897		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2306425		Issue Tracking
https://git.kernel.org/stable/c/75181406b4eafacc531ff2ee5fb032bd93317e2b		Patch
https://git.kernel.org/stable/c/bb2c2e62539f2b63c5e0beb51501d328260c7595		Patch
https://lore.kernel.org/linux-cve-announce/2024082112-CVE-2023-52897-e4ef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52897
https://www.cve.org/CVERecord?id=CVE-2023-52897