In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock<\/p>\n
[FALSE ALERTS]
\nThere is a bug report that the warning inside
\ninvalidate_and_check_btree_folios() got triggered during btrfs\/298:<\/p>\n
BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2
\n BTRFS info (device sdd): using crc32c checksum algorithm
\n BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices
\n BTRFS error (device sdd): failed to read chunk tree: -2
\n ————[ cut here ]————
\n WARNING: disk-io.c:3342 at invalidate_and_check_btree_folios+0x260\/0x3c0 [btrfs], CPU#4: mount\/125993
\n CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G W OE 7.1.0-rc7-custom+ #1 PREEMPT(full)
\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08\/12\/2025
\n Call trace:
\n invalidate_and_check_btree_folios+0x260\/0x3c0 [btrfs] (P)
\n open_ctree+0x1f50\/0x23b0 [btrfs]
\n btrfs_get_tree+0x89c\/0xc48 [btrfs]
\n vfs_get_tree+0x30\/0x110
\n vfs_cmd_create+0x58\/0xe8
\n __arm64_sys_fsconfig+0x39c\/0x518
\n invoke_syscall.constprop.0+0x48\/0x120
\n el0_svc_common.constprop.0+0x40\/0xe8
\n do_el0_svc+0x24\/0x38
\n el0_svc+0x50\/0x310
\n el0t_64_sync_handler+0xa0\/0xe8
\n el0t_64_sync+0x198\/0x1a0
\n —[ end trace 0000000000000000 ]—
\n BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5<\/p>\n
[CAUSE]
\nIn that invalidate_and_check_btree_folios() we wait for the eb to finish
\nits read, then check if it’s only held by us and the btree inode.<\/p>\n
If not, then do a warning as it may be still held, and could cause
\nproblems.<\/p>\n
But there is a small window where the check can lead to false alerts:<\/p>\n
Thread A (Read endio) | Thread B (Unmount)
\n———————————-+————————————-
\n end_bbio_meta_read() |
\n | The eb has one extra ref held |
\n | by the reader, and has |
\n | EXTENT_BUFFER_READING flag set | invalidate_and_check_btree_folios()
\n | | |
\n |- clear_extent_buffer_reading() | |
\n | | |- wait_on_bit_io();
\n | | | The EXTENT_BUFFER_READING flag is
\n | | | cleared
\n | | |- if (refcount_read(eb->refs) > 2)
\n | | The eb is held by the read, us
\n | | and btree inode, thus it
\n | | will trigger the warning
\n |- free_extent_buffer() |<\/p>\n
[FIX]
\nIntroduce a helper, free_extent_buffer_clear_reading().<\/p>\n
If the new parameter, @clear_reading, is set, we will hold the spinlock
\nat the beginning of free_extent_buffer_clear_reading() to make sure the
\nEXTENT_BUFFER_READING flag is cleared inside the same critical section
\nof decreasing refs.<\/p>\n
Now free_extent_buffer() will just call
\nfree_extent_buffer_clear_reading() with @clear_reading set to false, so
\nno behavior change.<\/p>\n
But for end_bbio_meta_read(), it will not clear_extent_buffer_reading()
\ndirectly, but pass @clear_reading as true.<\/p>\n
Then inside invalidate_and_check_btree_folios(), hold the refs_lock
\nbefore reading refs.
\nSo that we eliminate the race window completely.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock<\/p>\n
[FALSE ALERTS]
\nThere is a bug report that the warning inside
\ninv<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28519","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}