{"id":"DEBIAN-CVE-2023-54002","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix assertion of exclop condition when starting balance  Balance as exclusive state is compatible with paused balance and device add, which makes some things more complicated. The assertion of valid states when starting from paused balance needs to take into account two more states, the combinations can be hit when there are several threads racing to start balance and device add. This won't typically happen when the commands are started from command line.  Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE.  Concurrently adding multiple devices to the same mount point and btrfs_exclop_finish executed finishes before assertion in btrfs_exclop_balance, exclusive_operation will changed to BTRFS_EXCLOP_NONE state which lead to assertion failed:    fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_BALANCE ||   fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_DEV_ADD,   in fs/btrfs/ioctl.c:456   Call Trace:    \u003cTASK\u003e    btrfs_exclop_balance+0x13c/0x310    ? memdup_user+0xab/0xc0    ? PTR_ERR+0x17/0x20    btrfs_ioctl_add_dev+0x2ee/0x320    btrfs_ioctl+0x9d5/0x10d0    ? btrfs_ioctl_encoded_write+0xb80/0xb80    __x64_sys_ioctl+0x197/0x210    do_syscall_64+0x3c/0xb0    entry_SYSCALL_64_after_hwframe+0x63/0xcd  Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED.  Concurrently adding multiple devices to the same mount point and btrfs_exclop_balance executed finish before the latter thread execute assertion in btrfs_exclop_balance, exclusive_operation will changed to BTRFS_EXCLOP_BALANCE_PAUSED state which lead to assertion failed:    fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_BALANCE ||   fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_DEV_ADD ||   fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_NONE,   fs/btrfs/ioctl.c:458   Call Trace:    \u003cTASK\u003e    btrfs_exclop_balance+0x240/0x410    ? memdup_user+0xab/0xc0    ? PTR_ERR+0x17/0x20    btrfs_ioctl_add_dev+0x2ee/0x320    btrfs_ioctl+0x9d5/0x10d0    ? btrfs_ioctl_encoded_write+0xb80/0xb80    __x64_sys_ioctl+0x197/0x210    do_syscall_64+0x3c/0xb0    entry_SYSCALL_64_after_hwframe+0x63/0xcd  An example of the failed assertion is below, which shows that the paused balance is also needed to be checked.    root@syzkaller:/home/xsk# ./repro   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   Failed to add device /dev/vda, errno 14   [  416.611428][ T7970] BTRFS info (device loop0): fs_info exclusive_operation: 0   Failed to add device /dev/vda, errno 14   [  416.613973][ T7971] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.615456][ T7972] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.617528][ T7973] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.618359][ T7974] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.622589][ T7975] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.624034][ T7976] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.626420][ T7977] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.627643][ T7978] BTRFS info (device loop0): fs_info exclusive_operation: 3   Failed to add device /dev/vda, errno 14   [  416.629006][ T7979] BTRFS info (device loop0): fs_info exclusive_operation: 3   [  416.630298][ T7980] BTRFS info (device loop0): fs_info exclusive_operation: 3   Fai ---truncated---","modified":"2026-09-15T08:47:26.479955199Z","published":"2025-12-24T11:15:53.117Z","upstream":["CVE-2023-54002"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-54002"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.37-1"}]}],"versions":["6.1.27-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54002.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54002.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54002.json"}}],"schema_version":"1.9.0"}