Received-SPF: pass (google.com: domain of linux-kernel+bounces-184546-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Tue, 21 May 2024 09:05:27 +0200
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Filipe Manana <fdmanana@kernel.org>
Cc: cve@kernel.org, linux-kernel@vger.kernel.org,
	linux-cve-announce@vger.kernel.org
Subject: Re: CVE-2024-26904: btrfs: fix data race at btrfs_use_block_rsv()
 when accessing block reserve
Message-ID: <2024052155-raking-onshore-f6f3@gregkh>
References: <2024041746-CVE-2024-26904-e3a8@gregkh>
 <Zkt48ug3KKOTQk42@debian0.Home>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Zkt48ug3KKOTQk42@debian0.Home>

On Mon, May 20, 2024 at 05:23:14PM +0100, Filipe Manana wrote:
> On Wed, Apr 17, 2024 at 12:29:19PM +0200, Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
> 
> May I ask why is this classified a CVE?
> 
> How can a malicious user exploit this to do something harmful?
> 
> The race was solved to silence KCSAN warnings, as from time to time we have
> someone reporting it, but other than that, it should be harmless.

Oops, you are right, the line "BUG:" triggered our review to tag this as
a CVE.  I'll go reject it now, thanks for the review.

greg k-h