CVE-2023-53429

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't check PageError in __extent_writepage

__extent_writepage currenly sets PageError whenever any error happens, and the also checks for PageError to decide if to call error handling. This leads to very unclear responsibility for cleaning up on errors. In the VM and generic writeback helpers the basic idea is that once I/O is fired off all error handling responsibility is delegated to the end I/O handler. But if that end I/O handler sets the PageError bit, and the submitter checks it, the bit could in some cases leak into the submission context for fast enough I/O.

Fix this by simply not checking PageError and just using the local ret variable to check for submission errors. This also fundamentally solves the long problem documented in a comment in __extent_writepage by never leaking the error bit into the submission context.

A flaw was found in the Linux kernel's btrfs implementation in the way __extent_writepage handles writeback errors. The function sets PageError whenever an error occurs and also checks PageError to decide whether to invoke error handling, which leaves responsibility for cleanup after errors unclear. For sufficiently fast I/O, the PageError bit set by the end-I/O handler can leak into the submission context, where the submitter can incorrectly treat it as a submission error. Red Hat assesses the impact of this flaw as Low: it is a local error-handling correctness defect in btrfs writeback that can at most affect availability, with no impact on confidentiality or integrity, as reflected in the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The higher 7.8 score published in the upstream CVE record is not supported by the technical evidence, which does not establish any confidentiality or integrity impact. The affected code is present in the Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel and kernel-rt packages, where the fix has been deferred given the Low severity of the issue; the residual risk on those systems is limited to incorrect error cleanup during btrfs writeback. Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.