btrfs: fix assertion of exclop condition when starting balance

{
  "id": "f93fad855f6994481d01c7c657ca2d0c4010c29af850bba5fdf84d5f6ad00f75",
  "url": "https://osv.dev/vulnerability/CVE-2023-54002",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "btrfs: fix assertion of exclop condition when starting balance",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion of exclop condition when starting balance Balance as exclusive state is compatible with paused balance and device add, which makes some things more complicated. The assertion of valid states when starting from paused balance needs to take into account two more states, the combinations can be hit when there are several threads racing to start balance and device add. This won't typically happen when the commands are started from command line. Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE. Concurrently adding multiple devices to the same mount point and btrfs_exclop_finish executed finishes before assertion in btrfs_exclop_balance, exclusive_operation will changed to BTRFS_EXCLOP_NONE state which lead to assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE || fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD, in fs/btrfs/ioctl.c:456 Call Trace: btrfs_exclop_balance+0x13c/0x310 ? memdup_user+0xab/0xc0 ? PTR_ERR+0x17/0x20 btrfs_ioctl_add_dev+0x2ee/0x320 btrfs_ioctl+0x9d5/0x10d0 ? btrfs_ioctl_encoded_write+0xb80/0xb80 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x3c/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED. Concurrently adding multiple devices to the same mount point and btrfs_exclop_balance executed finish before the latter thread execute assertion in btrfs_exclop_balance, exclus",
    "evidence": "osv:CVE-2023-54002",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.29",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.2.16",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.3.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2023-54002",
      "aliases": [
        "CVE-2023-54002"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "a174c0a2e857081195db6888323802f0fae793ef"
                },
                {
                  "fixed": "17eaeee4c5f24946aad0298d51f32981c3161d13"
                },
                {
                  "fixed": "7877dc1136ada770622d22041be306539902951b"
                },
                {
                  "fixed": "6062e9e335a3bf409b5118bfe4cc10aff4b6adb1"
                },
                {
                  "fixed": "ac868bc9d136cde6e3eb5de77019a63d57a540ff"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54002.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.17.0"
                },
                {
                  "fixed": "6.1.29"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.2.16"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.3.0"
                },
                {
                  "fixed": "6.3.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54002.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.234796635Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/17eaeee4c5f24946aad0298d51f32981c3161d13",
        "https://git.kernel.org/stable/c/6062e9e335a3bf409b5118bfe4cc10aff4b6adb1",
        "https://git.kernel.org/stable/c/7877dc1136ada770622d22041be306539902951b",
        "https://git.kernel.org/stable/c/ac868bc9d136cde6e3eb5de77019a63d57a540ff",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54002.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-54002",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54002.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54002",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 504817,
  "published_at": "2025-12-24T10:55:37.699+00:00"
}