In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not BUG_ON() when freeing tree block after error
When freeing a tree block, at btrfsfreetreeblock(), if we fail to create a delayed reference we don't deal with the error and just do a BUGON(). The error most likely to happen is -ENOMEM, and we have a comment mentioning that only -ENOMEM can happen, but that is not true, because in case qgroups are enabled any error returned from btrfsqgrouptraceextentpost() (can be -EUCLEAN or anything returned from btrfssearchslot() for example) can be propagated back to btrfsfreetree_block().
So stop doing a BUG_ON() and return the error to the callers and make them abort the transaction to prevent leaking space. Syzbot was triggering this, likely due to memory allocation failure injection.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"330806976014871583365181137474560947917",
"186697953315725646403077878534134287737",
"305206617484481279040130980035732862472",
"59045900504304705157329825700163648431",
"128603578249715423212771726782179725331",
"247209341710303904679699775531483238840"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/free-space-tree.c"
},
"id": "CVE-2024-44963-40350a50"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3558.0,
"function_hash": "315374491894704231244483327282389630442"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ioctl.c",
"function": "create_subvol"
},
"id": "CVE-2024-44963-441ceacb"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"267651363931643399086706220192468678702",
"287971949421202463660837527303453734100",
"29570671109793438709927740252241908882",
"251729375939727210499664454255826691059",
"47773065028462167850361914149147339726",
"286397960731400547367445298055582510494",
"45001265321635032414363816534619128232",
"167339987373048107223109004387107847680"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ioctl.c"
},
"id": "CVE-2024-44963-45609e2a"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"67083055703281244897217479291792538337",
"127603916612557510490085102994638916527",
"286108061596550888888318390510629888715",
"58985866213214179560818736047141461926",
"7476460811884078066461785610763400576",
"266167285124381566895162962570281809108",
"312078805511764138441119799536334286703"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/extent-tree.h"
},
"id": "CVE-2024-44963-493e55ba"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2564.0,
"function_hash": "16971568636124993406650809808302834156"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/extent-tree.c",
"function": "walk_up_proc"
},
"id": "CVE-2024-44963-4fdbdd4e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1518.0,
"function_hash": "105961710945976155489698459428798995500"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_quota_disable"
},
"id": "CVE-2024-44963-6da73e3b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"287393189468798833039960283813631238240",
"148232646884343245044115131381026043117",
"51941370443889301117134717987743695952",
"335761469586857900072720250556222685897",
"115204993706171970162980428976553884920"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-44963-6e24c596"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1282.0,
"function_hash": "38480999097139213933469873144601884698"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ctree.c",
"function": "insert_new_root"
},
"id": "CVE-2024-44963-6fb9acaa"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2916.0,
"function_hash": "6398488086653888315931906629677064671"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ctree.c",
"function": "__btrfs_cow_block"
},
"id": "CVE-2024-44963-8eba2920"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"103066135286956250855559792842639204448",
"266928433528638855777596142519328453845",
"34151902428601298900799921724656727095",
"271929909779591012795663938804375152928",
"119338127558567096118683934135079545453",
"49635331141355248259842826597490004969",
"130386383386379877949314478403841688008",
"168299294232789246975042365503744372657",
"26552675520533565622471028622545362714",
"296976406196428005126712899426617224973",
"63143229005370503654959030610622375133",
"269922654896256464179373467606225731699",
"289622638551349224444878242822291490946",
"285407210303632060654441378244130229541",
"236401087798413484525794254593923519280",
"283486963256966542687127696839168303665",
"303564816275648695000952042196744674011",
"114687379982704215001585836175335806530",
"60611049887394099645589672759361156763",
"244259909850718687899356964935632333384",
"330898661081571894900350290109721324578",
"75766265750131477300637597883897147380",
"79204616524602254262681964287145991584",
"196257705520990797368899636116554433006",
"145099577876610184373411269220016252077",
"95786920897770298860220094192507698646",
"49667981173212430490565500279797329299",
"233080479930979474218245543889990845308"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/extent-tree.c"
},
"id": "CVE-2024-44963-992f3921"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4472.0,
"function_hash": "135569204162874253132946395853169831817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ctree.c",
"function": "balance_level"
},
"id": "CVE-2024-44963-a9f5736e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1438.0,
"function_hash": "176638415907280175174983139132457448251"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/extent-tree.c",
"function": "btrfs_free_tree_block"
},
"id": "CVE-2024-44963-b2f66684"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 437.0,
"function_hash": "287707711334248030391742774351838843960"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ctree.c",
"function": "btrfs_del_leaf"
},
"id": "CVE-2024-44963-b3f9e080"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"125362952994843146046659591260781611200",
"292151955289753915419493972639272744208",
"66179290745182759427992374184036538955",
"170299310912847037938216346002924598122",
"144708001943214478055102331857566989980",
"154019666493113545883360350785037063162",
"247564066792105241215887810741532984002",
"126639130495786117944014834824455787664",
"224204970242314309845400373961430539101",
"18352479160071152992768524864562379527",
"234080799027667935024290232283637123743",
"251863019832897797686233960476082072905",
"71303103852381382836395848312905390431",
"66996027779112755571295642195227380906",
"247205867245338587093519333714445113168",
"239127862584775492648315651465245523657",
"122234690648658035597876468007432258681",
"89010169174673953846643767599457055587",
"7269256147354071088759225800608383298",
"327987156612703316681941106093110559899",
"257701252802017567801009569547879633473",
"25418524650477487532012889893657565104",
"15902899663662466530175535321936821440",
"286608695094577956899821391825362964627",
"141085983978432924073632156152510823487",
"67128164034047953696232787994918958243",
"67163639038528247403014927562480284812",
"149448298435814333124247924134349219260",
"218252035708410161146814785516291187143",
"181370288610340976336483002150162922265",
"2428488663438857453011898355949070006",
"187345132278590016435721451413187375292",
"339229348505438280782232155013303233294",
"181603748130340189192456595056830344995",
"109748545218124234273935237253972281357",
"295016693438550722183758395464793647466",
"7474936454385706419781610733253228452",
"322241338179482216907650996357728665457",
"275708485855214894968616973419450086324",
"208524258188272624616723830843170244991"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/ctree.c"
},
"id": "CVE-2024-44963-caad56eb"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 916.0,
"function_hash": "21930506157082048830881294973818856106"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22d907bcd283d69d5e60497fc0d51969545c583b",
"target": {
"file": "fs/btrfs/free-space-tree.c",
"function": "btrfs_delete_free_space_tree"
},
"id": "CVE-2024-44963-cb58cf0d"
}
]