Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-56759

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 3083ee2e18b701122a3b841db83448543a87a583 to < ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1affected
  • 3083ee2e18b701122a3b841db83448543a87a583 to < 526ff5b27f090fb15040471f892cd2c9899ce314affected
  • 3083ee2e18b701122a3b841db83448543a87a583 to < 66376f1a73cba57fd0af2631d7888605b738e499affected
  • 3083ee2e18b701122a3b841db83448543a87a583 to < 9a466b8693b9add05de99af00c7bdff8259ecf19affected
  • 3083ee2e18b701122a3b841db83448543a87a583 to < c3a403d8ce36f5a809a492581de5ad17843e4701affected
  • 3083ee2e18b701122a3b841db83448543a87a583 to < 44f52bbe96dfdbe4aca3818a2534520082a07040affected

Linux Linux

Default version status: affected

  • 3.4affected
  • 0 to < 3.4unaffected
  • 5.10.233 to ≤ 5.10.*unaffected
  • 5.15.176 to ≤ 5.15.*unaffected
  • 6.1.124 to ≤ 6.1.*unaffected
  • 6.6.70 to ≤ 6.6.*unaffected
  • 6.12.8 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References