In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: zoned: don’t clobber the extent buffer when zeroing it out<\/p>\n
On a zoned filesystem a freed-but-still-dirty tree block is written out
\nas zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write
\npointer advancing. btree_csum_one_bio() implemented this by memzeroing
\nthe extent buffer’s own folios before submission.<\/p>\n
That destroys the in-memory buffer while it may still be referenced. In
\nparticular btrfs_free_tree_block() can run on it afterwards and reads
\nthe header to add a delayed reference; once the header has been zeroed
\nit frees bytenr 0 and corrupts the extent tree (the
\nbtrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an
\n“unable to find ref” abort). It is flaky and reproduces under fsstress,
\ne.g. generic\/461 and generic\/013.<\/p>\n
Write the zeros to disk from the shared zero page instead and leave the
\nextent buffer content untouched, so any later reference – including the
\ndelayed reference from btrfs_free_tree_block() – still sees a valid
\nheader. end_bbio_meta_write() now clears writeback on the buffer’s own
\nfolios, as the bio no longer carries them.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: zoned: don’t clobber the extent buffer when zeroing it out<\/p>\n
On a zoned filesystem a freed-but-still-dirty tree block is writ<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25669","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}