{"id":"DEBIAN-CVE-2023-54224","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix lockdep splat and potential deadlock after failure running delayed items  When running delayed items we are holding a delayed node's mutex and then we will attempt to modify a subvolume btree to insert/update/delete the delayed items. However if have an error during the insertions for example, btrfs_insert_delayed_items() may return with a path that has locked extent buffers (a leaf at the very least), and then we attempt to release the delayed node at __btrfs_run_delayed_items(), which requires taking the delayed node's mutex, causing an ABBA type of deadlock. This was reported by syzbot and the lockdep splat is the following:    WARNING: possible circular locking dependency detected   6.5.0-rc7-syzkaller-00024-g93f5de5f648d #0 Not tainted   ------------------------------------------------------   syz-executor.2/13257 is trying to acquire lock:   ffff88801835c0c0 (&delayed_node-\u003emutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256    but task is already holding lock:   ffff88802a5ab8e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_lock+0x3c/0x2a0 fs/btrfs/locking.c:198    which lock already depends on the new lock.    the existing dependency chain (in reverse order) is:    -\u003e #1 (btrfs-tree-00){++++}-{3:3}:          __lock_release kernel/locking/lockdep.c:5475 [inline]          lock_release+0x36f/0x9d0 kernel/locking/lockdep.c:5781          up_write+0x79/0x580 kernel/locking/rwsem.c:1625          btrfs_tree_unlock_rw fs/btrfs/locking.h:189 [inline]          btrfs_unlock_up_safe+0x179/0x3b0 fs/btrfs/locking.c:239          search_leaf fs/btrfs/ctree.c:1986 [inline]          btrfs_search_slot+0x2511/0x2f80 fs/btrfs/ctree.c:2230          btrfs_insert_empty_items+0x9c/0x180 fs/btrfs/ctree.c:4376          btrfs_insert_delayed_item fs/btrfs/delayed-inode.c:746 [inline]          btrfs_insert_delayed_items fs/btrfs/delayed-inode.c:824 [inline]          __btrfs_commit_inode_delayed_items+0xd24/0x2410 fs/btrfs/delayed-inode.c:1111          __btrfs_run_delayed_items+0x1db/0x430 fs/btrfs/delayed-inode.c:1153          flush_space+0x269/0xe70 fs/btrfs/space-info.c:723          btrfs_async_reclaim_metadata_space+0x106/0x350 fs/btrfs/space-info.c:1078          process_one_work+0x92c/0x12c0 kernel/workqueue.c:2600          worker_thread+0xa63/0x1210 kernel/workqueue.c:2751          kthread+0x2b8/0x350 kernel/kthread.c:389          ret_from_fork+0x2e/0x60 arch/x86/kernel/process.c:145          ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304    -\u003e #0 (&delayed_node-\u003emutex){+.+.}-{3:3}:          check_prev_add kernel/locking/lockdep.c:3142 [inline]          check_prevs_add kernel/locking/lockdep.c:3261 [inline]          validate_chain kernel/locking/lockdep.c:3876 [inline]          __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144          lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761          __mutex_lock_common+0x1d8/0x2530 kernel/locking/mutex.c:603          __mutex_lock kernel/locking/mutex.c:747 [inline]          mutex_lock_nested+0x1b/0x20 kernel/locking/mutex.c:799          __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256          btrfs_release_delayed_node fs/btrfs/delayed-inode.c:281 [inline]          __btrfs_run_delayed_items+0x2b5/0x430 fs/btrfs/delayed-inode.c:1156          btrfs_commit_transaction+0x859/0x2ff0 fs/btrfs/transaction.c:2276          btrfs_sync_file+0xf56/0x1330 fs/btrfs/file.c:1988          vfs_fsync_range fs/sync.c:188 [inline]          vfs_fsync fs/sync.c:202 [inline]          do_fsync fs/sync.c:212 [inline]          __do_sys_fsync fs/sync.c:220 [inline]          __se_sys_fsync fs/sync.c:218 [inline]          __x64_sys_fsync+0x196/0x1e0 fs/sync.c:218          do_syscall_x64 arch/x86/entry/common.c:50 [inline]          do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80          entry_SYSCALL_64_after_hwframe+0x63/0xcd    other info that ---truncated---","modified":"2026-09-15T08:47:26.886739801Z","published":"2025-12-30T13:16:10.743Z","upstream":["CVE-2023-54224"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-54224"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.55-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54224.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54224.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54224.json"}}],"schema_version":"1.9.0"}