CVE-2024-58089

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double accounting race when btrfs_run_delalloc_range() failed

[BUG]

When running btrfs with block size (4K) smaller than page size (64K,

aarch64), there is a very high chance to crash the kernel at

generic/750, with the following messages:

(before the call traces, there are 3 extra debug messages added)

BTRFS warning (device dm-3): read-write for sector size 4096 with page size 65536 is experimental

BTRFS info (device dm-3): checking UUID tree

hrtimer: interrupt took 5451385 ns

BTRFS error (device dm-3): cow_file_range failed, root=4957 inode=257 start=1605632 len=69632: -28

BTRFS error (device dm-3): run_delalloc_nocow failed, root=4957 inode=257 start=1605632 len=69632: -28

BTRFS error (device dm-3): failed to run delalloc range, root=4957 ino=257 folio=1572864 submit_bitmap=8-15 start=1605632 len=69632: -28

------------[ cut here ]------------

WARNING: CPU: 2 PID: 3020984 at ordered-data.c:360 can_finish_ordered_extent+0x370/0x3b8 [btrfs]

CPU: 2 UID: 0 PID: 3020984 Comm: kworker/u24:1 Tainted: G OE 6.13.0-rc1-custom+ #89

Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE

Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022

Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]

pc : can_finish_ordered_extent+0x370/0x3b8 [btrfs]

lr : can_finish_ordered_extent+0x1ec/0x3b8 [btrfs]

Call trace:

can_finish_ordered_extent+0x370/0x3b8 [btrfs] (P)

can_finish_ordered_extent+0x1ec/0x3b8 [btrfs] (L)

btrfs_mark_ordered_io_finished+0x130/0x2b8 [btrfs]

extent_writepage+0x10c/0x3b8 [btrfs]

extent_write_cache_pages+0x21c/0x4e8 [btrfs]

btrfs_writepages+0x94/0x160 [btrfs]

do_writepages+0x74/0x190

filemap_fdatawrite_wbc+0x74/0xa0

start_delalloc_inodes+0x17c/0x3b0 [btrfs]

btrfs_start_delalloc_roots+0x17c/0x288 [btrfs]

shrink_delalloc+0x11c/0x280 [btrfs]

flush_space+0x288/0x328 [btrfs]

btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]

process_one_work+0x228/0x680

worker_thread+0x1bc/0x360

kthread+0x100/0x118

ret_from_fork+0x10/0x20

---[ end trace 0000000000000000 ]---

BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1605632 OE len=16384 to_dec=16384 left=0

BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1622016 OE len=12288 to_dec=12288 left=0

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1634304 OE len=8192 to_dec=4096 left=0

CPU: 1 UID: 0 PID: 3286940 Comm: kworker/u24:3 Tainted: G W OE 6.13.0-rc1-custom+ #89

Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022

Workqueue: btrfs_work_helper [btrfs] (btrfs-endio-write)

pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : process_one_work+0x110/0x680

lr : worker_thread+0x1bc/0x360

Call trace:

process_one_work+0x110/0x680 (P)

worker_thread+0x1bc/0x360 (L)

worker_thread+0x1bc/0x360

kthread+0x100/0x118

ret_from_fork+0x10/0x20

Code: f84086a1 f9000fe1 53041c21 b9003361 (f9400661)

---[ end trace 0000000000000000 ]---

Kernel panic - not syncing: Oops: Fatal exception

SMP: stopping secondary CPUs

SMP: failed to stop secondary CPUs 2-3

Dumping ftrace buffer:

(ftrace buffer empty)

Kernel Offset: 0x275bb9540000 from 0xffff800080000000

PHYS_OFFSET: 0xffff8fbba0000000

CPU features: 0x100,00000070,00801250,8201720b

[CAUSE]

The above warning is triggered immediately after the delalloc range

failure, this happens in the following sequence:

- Range [1568K, 1636K) is dirty

1536K 1568K 1600K 1636K 1664K

| |/////////|////////| |

Where 1536K, 1600K and 1664K are page boundaries (64K page size)

- Enter extent_writepage() for page 1536K

- Enter run_delalloc_nocow() with locke

---truncated---