In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: fix block_group_tree dirty_list corruption<\/p>\n
When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the
\nblock group tree to the switch_commits list before calling
\nswitch_commit_roots, as we do for the tree root and the chunk root.
\nHowever, the block group tree uses normal root dirty tracking and in any
\ntransaction that does an allocation and dirties a block group, the block
\ngroup root will already be linked to a list by the dirty_list field and
\nthis use of list_add_tail() is invalid and corrupts the prev\/next
\nmembers of block_group_root->dirty_list.<\/p>\n
This is apparent on a subsequent list_del on the prev if we enable
\nCONFIG_DEBUG_LIST:<\/p>\n
[32.1571] ————[ cut here ]————
\n [32.1572] list_del corruption. next->prev should beffff958890202538, but was ffff9588992bd538. (next=ffff958890201538)
\n [32.1575] WARNING: lib\/list_debug.c:65 at 0x0, CPU#3: sync\/607
\n [32.1583] CPU: 3 UID: 0 PID: 607 Comm: sync Not tainted 6.18.0 #24PREEMPT(none)
\n [32.1585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS1.17.0-4.fc41 04\/01\/2014
\n [32.1587] RIP: 0010:__list_del_entry_valid_or_report+0x108\/0x120
\n [32.1593] RSP: 0018:ffffaa288287fdd0 EFLAGS: 00010202
\n [32.1594] RAX: 0000000000000001 RBX: ffff95889326e800 RCX:ffff958890201538
\n [32.1596] RDX: ffff9588992bd538 RSI: ffff958890202538 RDI:ffffffff82a41e00
\n [32.1597] RBP: ffff958890202538 R08: ffffffff828fc1e8 R09:00000000ffffefff
\n [32.1599] R10: ffffffff8288c200 R11: ffffffff828e4200 R12:ffff958890201538
\n [32.1601] R13: ffff95889326e958 R14: ffff958895c24000 R15:ffff958890202538
\n [32.1603] FS: 00007f0c28eb5740(0000) GS:ffff958af2bd2000(0000)knlGS:0000000000000000
\n [32.1605] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\n [32.1607] CR2: 00007f0c28e8a3cc CR3: 0000000109942005 CR4:0000000000370ef0
\n [32.1609] Call Trace:
\n [32.1610]
\n [32.1611] switch_commit_roots+0x82\/0x1d0 [btrfs]
\n [32.1615] btrfs_commit_transaction+0x968\/0x1550 [btrfs]
\n [32.1618] ? btrfs_attach_transaction_barrier+0x23\/0x60 [btrfs]
\n [32.1621] __iterate_supers+0xe8\/0x190
\n [32.1622] ? __pfx_sync_fs_one_sb+0x10\/0x10
\n [32.1623] ksys_sync+0x63\/0xb0
\n [32.1624] __do_sys_sync+0xe\/0x20
\n [32.1625] do_syscall_64+0x73\/0x450
\n [32.1626] entry_SYSCALL_64_after_hwframe+0x76\/0x7e
\n [32.1627] RIP: 0033:0x7f0c28d05d2b
\n [32.1632] RSP: 002b:00007ffc9d988048 EFLAGS: 00000246 ORIG_RAX:00000000000000a2
\n [32.1634] RAX: ffffffffffffffda RBX: 00007ffc9d988228 RCX:00007f0c28d05d2b
\n [32.1636] RDX: 00007f0c28e02301 RSI: 00007ffc9d989b21 RDI:00007f0c28dba90d
\n [32.1637] RBP: 0000000000000001 R08: 0000000000000001 R09:0000000000000000
\n [32.1639] R10: 0000000000000000 R11: 0000000000000246 R12:000055b96572cb80
\n [32.1641] R13: 000055b96572b19f R14: 00007f0c28dfa434 R15:000055b96572b034
\n [32.1643]
\n [32.1644] irq event stamp: 0
\n [32.1644] hardirqs last enabled at (0): [] 0x0
\n [32.1646] hardirqs last disabled at (0): []copy_process+0xb37\/0x2260
\n [32.1648] softirqs last enabled at (0): []copy_process+0xb37\/0x2260
\n [32.1650] softirqs last disabled at (0): [] 0x0
\n [32.1652] —[ end trace 0000000000000000 ]—<\/p>\n
Furthermore, this list corruption eventually (when we happen to add a
\nnew block group) results in getting the switch_commits and
\ndirty_cowonly_roots lists mixed up and attempting to call update_root
\non the tree root which can’t be found in the tree root, resulting in a
\ntransaction abort:<\/p>\n
[87.8269] BTRFS critical (device nvme1n1): unable to find root key (1 0 0) in tree 1
\n [87.8272] ————[ cut here ]————
\n [87.8274] BTRFS: Transaction aborted (error -117)
\n [87.8275] WARNING: fs\/btrfs\/root-tree.c:153 at 0x0, CPU#4: sync\/703
\n [87.8285] CPU: 4 UID: 0 PID: 703 Comm: sync Not tainted 6.18.0 #25 PREEMPT(none)
\n [87.8287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-4.fc41 0
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: fix block_group_tree dirty_list corruption<\/p>\n
When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the
\nblock g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15468","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}