btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Résumé
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
From the memory-barriers.txt document regarding memory barrier ordering
guarantees:
(*) These guarantees do not apply to bitfields, because compilers often
generate code to modify these using non-atomic read-modify-write
sequences. Do not attempt to use bitfields to synchronize parallel
algorithms.
(*) Even in cases where bitfields are protected by locks, all fields
in a given bitfield must be protected by one lock. If two fields
in a given bitfield are protected by different locks, the compiler's
non-atomic read-modify-write sequences can cause an update to one
field to corrupt the value of an adjacent field.
btrfs_space_info has a bitfield sharing an underlying word consisting of
the fields full, chunk_alloc, and flush:
struct btrfs_space_info {
struct btrfs_fs_info * fs_info; /* 0 8 /
struct btrfs_space_info * parent; / 8 8 /
...
int clamp; / 172 4 /
unsigned int full:1; / 176: 0 4 /
unsigned int chunk_alloc:1; / 176: 1 4 /
unsigned int flush:1; / 176: 2 4 */
...
Therefore, to be safe from parallel read-modify-writes losing a write to
one of the bitfie…
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2025-68358 linux-lts Corrigé dans: 6.1.164-r0
- Debian DEBIAN-CVE-2025-68358 linux
- Ubuntu UBUNTU-CVE-2025-68358 linux-azure
Références
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org