In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix double accounting race when btrfsrundelalloc_range() failed
[BUG] When running btrfs with block size (4K) smaller than page size (64K, aarch64), there is a very high chance to crash the kernel at generic/750, with the following messages: (before the call traces, there are 3 extra debug messages added)
BTRFS warning (device dm-3): read-write for sector size 4096 with page size 65536 is experimental BTRFS info (device dm-3): checking UUID tree hrtimer: interrupt took 5451385 ns BTRFS error (device dm-3): cowfilerange failed, root=4957 inode=257 start=1605632 len=69632: -28 BTRFS error (device dm-3): rundelallocnocow failed, root=4957 inode=257 start=1605632 len=69632: -28 BTRFS error (device dm-3): failed to run delalloc range, root=4957 ino=257 folio=1572864 submitbitmap=8-15 start=1605632 len=69632: -28 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 3020984 at ordered-data.c:360 canfinishorderedextent+0x370/0x3b8 [btrfs] CPU: 2 UID: 0 PID: 3020984 Comm: kworker/u24:1 Tainted: G OE 6.13.0-rc1-custom+ #89 Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODULE Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: eventsunbound btrfsasyncreclaimdataspace [btrfs] pc : canfinishorderedextent+0x370/0x3b8 [btrfs] lr : canfinishorderedextent+0x1ec/0x3b8 [btrfs] Call trace: canfinishorderedextent+0x370/0x3b8 [btrfs] (P) canfinishorderedextent+0x1ec/0x3b8 [btrfs] (L) btrfsmarkorderediofinished+0x130/0x2b8 [btrfs] extentwritepage+0x10c/0x3b8 [btrfs] extentwritecachepages+0x21c/0x4e8 [btrfs] btrfswritepages+0x94/0x160 [btrfs] dowritepages+0x74/0x190 filemapfdatawritewbc+0x74/0xa0 startdelallocinodes+0x17c/0x3b0 [btrfs] btrfsstartdelallocroots+0x17c/0x288 [btrfs] shrinkdelalloc+0x11c/0x280 [btrfs] flushspace+0x288/0x328 [btrfs] btrfsasyncreclaimdataspace+0x180/0x228 [btrfs] processonework+0x228/0x680 workerthread+0x1bc/0x360 kthread+0x100/0x118 retfromfork+0x10/0x20 ---[ end trace 0000000000000000 ]--- BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1605632 OE len=16384 todec=16384 left=0 BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1622016 OE len=12288 todec=12288 left=0 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1634304 OE len=8192 todec=4096 left=0 CPU: 1 UID: 0 PID: 3286940 Comm: kworker/u24:3 Tainted: G W OE 6.13.0-rc1-custom+ #89 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: btrfsworkhelper [btrfs] (btrfs-endio-write) pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : processonework+0x110/0x680 lr : workerthread+0x1bc/0x360 Call trace: processonework+0x110/0x680 (P) workerthread+0x1bc/0x360 (L) workerthread+0x1bc/0x360 kthread+0x100/0x118 retfromfork+0x10/0x20 Code: f84086a1 f9000fe1 53041c21 b9003361 (f9400661) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 2-3 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: 0x275bb9540000 from 0xffff800080000000 PHYSOFFSET: 0xffff8fbba0000000 CPU features: 0x100,00000070,00801250,8201720b
[CAUSE] The above warning is triggered immediately after the delalloc range failure, this happens in the following sequence:
Range [1568K, 1636K) is dirty
1536K 1568K 1600K 1636K 1664K | |/////////|////////| |
Where 1536K, 1600K and 1664K are page boundaries (64K page size)
Enter extent_writepage() for page 1536K
Enter rundelallocnocow() with locke ---truncated---
[
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c",
"function": "writepage_delalloc"
},
"digest": {
"length": 2225.0,
"function_hash": "313328965381892710221453479835867396999"
},
"id": "CVE-2024-58089-09d0a1a9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21333148b5c9e52f41fafcedec3810b56a5e0e40",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c",
"function": "extent_writepage"
},
"digest": {
"length": 1192.0,
"function_hash": "277884028517239183336682059490211912105"
},
"id": "CVE-2024-58089-32c7dcfa",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21333148b5c9e52f41fafcedec3810b56a5e0e40",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165384774594551242437655542228328397429",
"213767233995814638542352887264483266755",
"198840122269006979541888417818736095651",
"283166281701526647551503441546401143216",
"70079223775952959869972032233981839382",
"270599359830551189522683311113059287867",
"159129095931117008323772995511511370368",
"98068292749490259267081353658569280582",
"309978298221020765416340711224896075208",
"253322250239596640230871509767800859695",
"70342698664839876738223554162554882224",
"247007538398970791448482505119965000538",
"140114715418721263956374275734769585971",
"88055093468215482231305602535073599977",
"120071898655300249936155483640588851625",
"303987971350581780147769788419413038286",
"66611600858883982283538541240149111673",
"134542237914338286245301063675375612624",
"316641597967525170212116953765539933469",
"101908027059840014963201540254233881144",
"161026761035724119385074042961192684872",
"133061226861724615920266462236076577579",
"61635871709911716676548806535358992957",
"107854963546291131572304961622273108626",
"238206646550626969427467858606776513794",
"305739445892628342530273096552189032538",
"107474046882009844242107634500974327461",
"119104653577552789611211562701403806164",
"51022330867041395911322241801571913055"
]
},
"id": "CVE-2024-58089-44d01ddf",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0283ee1912c8e243c931f4ee5b3672e954fe0384",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165384774594551242437655542228328397429",
"213767233995814638542352887264483266755",
"198840122269006979541888417818736095651",
"283166281701526647551503441546401143216",
"70079223775952959869972032233981839382",
"270599359830551189522683311113059287867",
"159129095931117008323772995511511370368",
"98068292749490259267081353658569280582",
"309978298221020765416340711224896075208",
"253322250239596640230871509767800859695",
"70342698664839876738223554162554882224",
"247007538398970791448482505119965000538",
"140114715418721263956374275734769585971",
"88055093468215482231305602535073599977",
"120071898655300249936155483640588851625",
"303987971350581780147769788419413038286",
"66611600858883982283538541240149111673",
"134542237914338286245301063675375612624",
"316641597967525170212116953765539933469",
"101908027059840014963201540254233881144",
"161026761035724119385074042961192684872",
"133061226861724615920266462236076577579",
"61635871709911716676548806535358992957",
"107854963546291131572304961622273108626",
"238206646550626969427467858606776513794",
"305739445892628342530273096552189032538",
"107474046882009844242107634500974327461",
"119104653577552789611211562701403806164",
"51022330867041395911322241801571913055"
]
},
"id": "CVE-2024-58089-5b10cdee",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21333148b5c9e52f41fafcedec3810b56a5e0e40",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c",
"function": "writepage_delalloc"
},
"digest": {
"length": 2225.0,
"function_hash": "313328965381892710221453479835867396999"
},
"id": "CVE-2024-58089-7ea35601",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0283ee1912c8e243c931f4ee5b3672e954fe0384",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/extent_io.c",
"function": "extent_writepage"
},
"digest": {
"length": 1192.0,
"function_hash": "277884028517239183336682059490211912105"
},
"id": "CVE-2024-58089-98ea2a41",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0283ee1912c8e243c931f4ee5b3672e954fe0384",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122810478464172778447797742816226039518",
"119646737407005189228508262725663678077",
"149152933092365915592293303158100542296",
"272439893074435303534566696562915541269",
"253097519054058451927656902381099225337"
]
},
"id": "CVE-2024-58089-9c2363ce",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21333148b5c9e52f41fafcedec3810b56a5e0e40",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/inode.c",
"function": "btrfs_run_delalloc_range"
},
"digest": {
"length": 751.0,
"function_hash": "203107446871229554500476028152178315035"
},
"id": "CVE-2024-58089-ac34f136",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21333148b5c9e52f41fafcedec3810b56a5e0e40",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122810478464172778447797742816226039518",
"119646737407005189228508262725663678077",
"149152933092365915592293303158100542296",
"272439893074435303534566696562915541269",
"253097519054058451927656902381099225337"
]
},
"id": "CVE-2024-58089-e798d3b8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0283ee1912c8e243c931f4ee5b3672e954fe0384",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/btrfs/inode.c",
"function": "btrfs_run_delalloc_range"
},
"digest": {
"length": 751.0,
"function_hash": "203107446871229554500476028152178315035"
},
"id": "CVE-2024-58089-f5281fc0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0283ee1912c8e243c931f4ee5b3672e954fe0384",
"signature_version": "v1"
}
]