CVE-2024-26616

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26616
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26616.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26616
Downstream
Related
Published
2024-02-29T15:52:19Z
Modified
2025-10-15T08:00:01.626280Z
Summary
btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned
Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned

[BUG] There is a bug report that, on a ext4-converted btrfs, scrub leads to various problems, including:

  • "unable to find chunk map" errors BTRFS info (device vdb): scrub: started on devid 1 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 4096 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 45056

    This would lead to unrepariable errors.

  • Use-after-free KASAN reports:

    BUG: KASAN: slab-use-after-free in _blkrqmapsg+0x18f/0x7c0 Read of size 8 at addr ffff8881013c9040 by task btrfs/909 CPU: 0 PID: 909 Comm: btrfs Not tainted 6.7.0-x64v3-dbg #11 c50636e9419a8354555555245df535e380563b2b Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2023.11-2 12/24/2023 Call Trace: <TASK> dumpstacklvl+0x43/0x60 printreport+0xcf/0x640 kasanreport+0xa6/0xd0 _blkrqmapsg+0x18f/0x7c0 virtblkpreprq.isra.0+0x215/0x6a0 [virtioblk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] virtioqueuerqs+0xc4/0x310 [virtioblk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] blkmqflushpluglist.part.0+0x780/0x860 _blkflushplug+0x1ba/0x220 blkfinishplug+0x3b/0x60 submitinitialgroupread+0x10a/0x290 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] flushscrubstripes+0x38e/0x430 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrubstripe+0x82a/0xae0 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrubchunk+0x178/0x200 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrubenumeratechunks+0x4bc/0xa30 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfsscrubdev+0x398/0x810 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfsioctl+0x4b9/0x3020 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] _x64sysioctl+0xbd/0x100 dosyscall64+0x5d/0xe0 entrySYSCALL64afterhwframe+0x63/0x6b RIP: 0033:0x7f47e5e0952b

  • Crash, mostly due to above use-after-free

[CAUSE] The converted fs has the following data chunk layout:

item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 2214658048) itemoff 16025 itemsize 80
    length 86016 owner 2 stripe_len 65536 type DATA|single

For above logical bytenr 2214744064, it's at the chunk end (2214658048 + 86016 = 2214744064).

This means btrfssubmitbio() would split the bio, and trigger endio function for both of the two halves.

However scrubsubmitinitial_read() would only expect the endio function to be called once, not any more. This means the first endio function would already free the bbio::bio, leaving the bvec freed, thus the 2nd endio call would lead to use-after-free.

[FIX] - Make sure scrubreadendio() only updates bits in its range Since we may read less than 64K at the end of the chunk, we should not touch the bits beyond chunk boundary.

  • Make sure scrubsubmitinitial_read() only to read the chunk range This is done by calculating the real number of sectors we need to read, and add sector-by-sector to the bio.

Thankfully the scrub read repair path won't need extra fixes:

  • scrubstripesubmitrepairread() With above fixes, we won't update error bit for range beyond chunk, thus scrubstripesubmitrepairread() should never submit any read beyond the chunk.
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e02ee89baa66c40e1002cf8b09141fce7265e0f5
Fixed
642b9c520ef2f104277ad1f902f8526edbe087fb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e02ee89baa66c40e1002cf8b09141fce7265e0f5
Fixed
34de0f04684ec00c093a0455648be055f0e8e24f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e02ee89baa66c40e1002cf8b09141fce7265e0f5
Fixed
f546c4282673497a06ecb6190b50ae7f6c85b02f

Affected versions

v6.*

v6.3
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2

Database specific 

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "fs/btrfs/scrub.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "225562295543881067538370871379932288581",
                    "328799393991590083872365059998496849229",
                    "52734562984290939433786683053032281972",
                    "285551807075070932452338468448936607525",
                    "334169106291358006553726107359427138515",
                    "177153748769447542157464634589479115987",
                    "264348595455663417757828447597884069812",
                    "294004079063284075020037274634265001625",
                    "94803610353436979167487055209204999572",
                    "337438043146480769231283942517908199026",
                    "9702347907638125752930796649372126606",
                    "223787704835549819092664022291396561778",
                    "37388497682879298305973981853086938270",
                    "1557414656850359943380136846189192980",
                    "93963744942074183068436223417163444406",
                    "139409235278305725673522799580483634271",
                    "145327745848935287929101206666713174828",
                    "131397322148958172084814430199241453354",
                    "77898805058579435732463052177730078724",
                    "233157055457449728147673020748534692819",
                    "93601677053568751588502053859719842961"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26616-07db729d",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34de0f04684ec00c093a0455648be055f0e8e24f"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_submit_initial_read"
            },
            "deprecated": false,
            "digest": {
                "length": 1070.0,
                "function_hash": "229662054782668922414520842232213134670"
            },
            "id": "CVE-2024-26616-432fa256",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34de0f04684ec00c093a0455648be055f0e8e24f"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_submit_initial_read"
            },
            "deprecated": false,
            "digest": {
                "length": 1070.0,
                "function_hash": "229662054782668922414520842232213134670"
            },
            "id": "CVE-2024-26616-4e432b3e",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f546c4282673497a06ecb6190b50ae7f6c85b02f"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_submit_initial_read"
            },
            "deprecated": false,
            "digest": {
                "length": 981.0,
                "function_hash": "18932895963625879058654938678260084052"
            },
            "id": "CVE-2024-26616-62c0338d",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@642b9c520ef2f104277ad1f902f8526edbe087fb"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_read_endio"
            },
            "deprecated": false,
            "digest": {
                "length": 548.0,
                "function_hash": "249279129418288642156230932579517584020"
            },
            "id": "CVE-2024-26616-6872373a",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@642b9c520ef2f104277ad1f902f8526edbe087fb"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_read_endio"
            },
            "deprecated": false,
            "digest": {
                "length": 548.0,
                "function_hash": "249279129418288642156230932579517584020"
            },
            "id": "CVE-2024-26616-72f67439",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34de0f04684ec00c093a0455648be055f0e8e24f"
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "fs/btrfs/scrub.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "225562295543881067538370871379932288581",
                    "328799393991590083872365059998496849229",
                    "52734562984290939433786683053032281972",
                    "285551807075070932452338468448936607525",
                    "334169106291358006553726107359427138515",
                    "177153748769447542157464634589479115987",
                    "264348595455663417757828447597884069812",
                    "294004079063284075020037274634265001625",
                    "94803610353436979167487055209204999572",
                    "337438043146480769231283942517908199026",
                    "9702347907638125752930796649372126606",
                    "223787704835549819092664022291396561778",
                    "37388497682879298305973981853086938270",
                    "250744470041210706763266216519236645943",
                    "93963744942074183068436223417163444406",
                    "139409235278305725673522799580483634271",
                    "145327745848935287929101206666713174828",
                    "131397322148958172084814430199241453354",
                    "77898805058579435732463052177730078724",
                    "233157055457449728147673020748534692819",
                    "93601677053568751588502053859719842961"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26616-a332b8da",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@642b9c520ef2f104277ad1f902f8526edbe087fb"
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "fs/btrfs/scrub.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "225562295543881067538370871379932288581",
                    "328799393991590083872365059998496849229",
                    "52734562984290939433786683053032281972",
                    "285551807075070932452338468448936607525",
                    "334169106291358006553726107359427138515",
                    "177153748769447542157464634589479115987",
                    "264348595455663417757828447597884069812",
                    "294004079063284075020037274634265001625",
                    "94803610353436979167487055209204999572",
                    "337438043146480769231283942517908199026",
                    "9702347907638125752930796649372126606",
                    "223787704835549819092664022291396561778",
                    "37388497682879298305973981853086938270",
                    "1557414656850359943380136846189192980",
                    "93963744942074183068436223417163444406",
                    "139409235278305725673522799580483634271",
                    "145327745848935287929101206666713174828",
                    "131397322148958172084814430199241453354",
                    "77898805058579435732463052177730078724",
                    "233157055457449728147673020748534692819",
                    "93601677053568751588502053859719842961"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26616-ae407004",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f546c4282673497a06ecb6190b50ae7f6c85b02f"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "fs/btrfs/scrub.c",
                "function": "scrub_read_endio"
            },
            "deprecated": false,
            "digest": {
                "length": 548.0,
                "function_hash": "249279129418288642156230932579517584020"
            },
            "id": "CVE-2024-26616-d79554da",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f546c4282673497a06ecb6190b50ae7f6c85b02f"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.15
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.3