CVE-2024-56759

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

High · published January 6, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

When a COWing a tree block, at btrfs_cow_block(), and we have the

tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled

(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent

buffer while inside the tracepoint code. This is because in some paths

that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding

the last reference on the extent buffer @buf so btrfs_force_cow_block()

drops the last reference on the @buf extent buffer when it calls

free_extent_buffer_stale(buf), which schedules the release of the extent

buffer with RCU. This means that if we are on a kernel with preemption,

the current task may be preempted before calling trace_btrfs_cow_block()

and the extent buffer already released by the time trace_btrfs_cow_block()

is called, resulting in a use-after-free.

Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to

btrfs_force_cow_block() before the COWed extent buffer is freed.

This also has a side effect of invoking the tracepoint in the tree defrag

code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is

called there, but this is fine and it was actually missing there.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Published
2025-01-06T16:20Z
EPSS history
Timeline
  • 06 JAN 16:20Z
    btrfs: fix use-after-free when COWing tree bock and tracing is enabled
    cvelistv5