cve-2024-38306
Vulnerability from cvelistv5
Published
2024-06-25 14:22
Modified
2024-11-05 09:29
Severity ?
EPSS score ?
Summary
btrfs: protect folio::private when attaching extent buffer folios
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:25.336Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/952f048eb901881a7cc6f7c1368b53cd386ead7b"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f3a5367c679d31473d3fbb391675055b4792c309"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T17:08:21.055578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:34:42.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "952f048eb901",
"status": "affected",
"version": "09e6cef19c9f",
"versionType": "git"
},
{
"lessThan": "f3a5367c679d",
"status": "affected",
"version": "09e6cef19c9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: protect folio::private when attaching extent buffer folios\n\n[BUG]\nSince v6.8 there are rare kernel crashes reported by various people,\nthe common factor is bad page status error messages like this:\n\n BUG: Bad page state in process kswapd0 pfn:d6e840\n page: refcount:0 mapcount:0 mapping:000000007512f4f2 index:0x2796c2c7c\n pfn:0xd6e840\n aops:btree_aops ino:1\n flags: 0x17ffffe0000008(uptodate|node=0|zone=2|lastcpupid=0x3fffff)\n page_type: 0xffffffff()\n raw: 0017ffffe0000008 dead000000000100 dead000000000122 ffff88826d0be4c0\n raw: 00000002796c2c7c 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: non-NULL mapping\n\n[CAUSE]\nCommit 09e6cef19c9f (\"btrfs: refactor alloc_extent_buffer() to\nallocate-then-attach method\") changes the sequence when allocating a new\nextent buffer.\n\nPreviously we always called grab_extent_buffer() under\nmapping-\u003ei_private_lock, to ensure the safety on modification on\nfolio::private (which is a pointer to extent buffer for regular\nsectorsize).\n\nThis can lead to the following race:\n\nThread A is trying to allocate an extent buffer at bytenr X, with 4\n4K pages, meanwhile thread B is trying to release the page at X + 4K\n(the second page of the extent buffer at X).\n\n Thread A | Thread B\n-----------------------------------+-------------------------------------\n | btree_release_folio()\n\t\t\t\t | | This is for the page at X + 4K,\n\t\t\t\t | | Not page X.\n\t\t\t\t | |\nalloc_extent_buffer() | |- release_extent_buffer()\n|- filemap_add_folio() for the | | |- atomic_dec_and_test(eb-\u003erefs)\n| page at bytenr X (the first | | |\n| page). | | |\n| Which returned -EEXIST. | | |\n| | | |\n|- filemap_lock_folio() | | |\n| Returned the first page locked. | | |\n| | | |\n|- grab_extent_buffer() | | |\n| |- atomic_inc_not_zero() | | |\n| | Returned false | | |\n| |- folio_detach_private() | | |- folio_detach_private() for X\n| |- folio_test_private() | | |- folio_test_private()\n | Returned true | | | Returned true\n |- folio_put() | |- folio_put()\n\nNow there are two puts on the same folio at folio X, leading to refcount\nunderflow of the folio X, and eventually causing the BUG_ON() on the\npage-\u003emapping.\n\nThe condition is not that easy to hit:\n\n- The release must be triggered for the middle page of an eb\n If the release is on the same first page of an eb, page lock would kick\n in and prevent the race.\n\n- folio_detach_private() has a very small race window\n It\u0027s only between folio_test_private() and folio_clear_private().\n\nThat\u0027s exactly when mapping-\u003ei_private_lock is used to prevent such race,\nand commit 09e6cef19c9f (\"btrfs: refactor alloc_extent_buffer() to\nallocate-then-attach method\") screwed that up.\n\nAt that time, I thought the page lock would kick in as\nfilemap_release_folio() also requires the page to be locked, but forgot\nthe filemap_release_folio() only locks one page, not all pages of an\nextent buffer.\n\n[FIX]\nMove all the code requiring i_private_lock into\nattach_eb_folio_to_filemap(), so that everything is done with proper\nlock protection.\n\nFurthermore to prevent future problems, add an extra\nlockdep_assert_locked() to ensure we\u0027re holding the proper lock.\n\nTo reproducer that is able to hit the race (takes a few minutes with\ninstrumented code inserting delays to alloc_extent_buffer()):\n\n #!/bin/sh\n drop_caches () {\n\t while(true); do\n\t\t echo 3 \u003e /proc/sys/vm/drop_caches\n\t\t echo 1 \u003e /proc/sys/vm/compact_memory\n\t done\n }\n\n run_tar () {\n\t while(true); do\n\t\t for x in `seq 1 80` ; do\n\t\t\t tar cf /dev/zero /mnt \u003e /dev/null \u0026\n\t\t done\n\t\t wait\n\t done\n }\n\n mkfs.btrfs -f -d single -m single\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T09:29:21.688Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/952f048eb901881a7cc6f7c1368b53cd386ead7b"
},
{
"url": "https://git.kernel.org/stable/c/f3a5367c679d31473d3fbb391675055b4792c309"
}
],
"title": "btrfs: protect folio::private when attaching extent buffer folios",
"x_generator": {
"engine": "bippy-9e1c9544281a"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-38306",
"datePublished": "2024-06-25T14:22:36.903Z",
"dateReserved": "2024-06-24T13:53:25.575Z",
"dateUpdated": "2024-11-05T09:29:21.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-38306\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-25T15:15:13.367\",\"lastModified\":\"2024-06-25T18:50:42.040\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: protect folio::private when attaching extent buffer folios\\n\\n[BUG]\\nSince v6.8 there are rare kernel crashes reported by various people,\\nthe common factor is bad page status error messages like this:\\n\\n BUG: Bad page state in process kswapd0 pfn:d6e840\\n page: refcount:0 mapcount:0 mapping:000000007512f4f2 index:0x2796c2c7c\\n pfn:0xd6e840\\n aops:btree_aops ino:1\\n flags: 0x17ffffe0000008(uptodate|node=0|zone=2|lastcpupid=0x3fffff)\\n page_type: 0xffffffff()\\n raw: 0017ffffe0000008 dead000000000100 dead000000000122 ffff88826d0be4c0\\n raw: 00000002796c2c7c 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: non-NULL mapping\\n\\n[CAUSE]\\nCommit 09e6cef19c9f (\\\"btrfs: refactor alloc_extent_buffer() to\\nallocate-then-attach method\\\") changes the sequence when allocating a new\\nextent buffer.\\n\\nPreviously we always called grab_extent_buffer() under\\nmapping-\u003ei_private_lock, to ensure the safety on modification on\\nfolio::private (which is a pointer to extent buffer for regular\\nsectorsize).\\n\\nThis can lead to the following race:\\n\\nThread A is trying to allocate an extent buffer at bytenr X, with 4\\n4K pages, meanwhile thread B is trying to release the page at X + 4K\\n(the second page of the extent buffer at X).\\n\\n Thread A | Thread B\\n-----------------------------------+-------------------------------------\\n | btree_release_folio()\\n\\t\\t\\t\\t | | This is for the page at X + 4K,\\n\\t\\t\\t\\t | | Not page X.\\n\\t\\t\\t\\t | |\\nalloc_extent_buffer() | |- release_extent_buffer()\\n|- filemap_add_folio() for the | | |- atomic_dec_and_test(eb-\u003erefs)\\n| page at bytenr X (the first | | |\\n| page). | | |\\n| Which returned -EEXIST. | | |\\n| | | |\\n|- filemap_lock_folio() | | |\\n| Returned the first page locked. | | |\\n| | | |\\n|- grab_extent_buffer() | | |\\n| |- atomic_inc_not_zero() | | |\\n| | Returned false | | |\\n| |- folio_detach_private() | | |- folio_detach_private() for X\\n| |- folio_test_private() | | |- folio_test_private()\\n | Returned true | | | Returned true\\n |- folio_put() | |- folio_put()\\n\\nNow there are two puts on the same folio at folio X, leading to refcount\\nunderflow of the folio X, and eventually causing the BUG_ON() on the\\npage-\u003emapping.\\n\\nThe condition is not that easy to hit:\\n\\n- The release must be triggered for the middle page of an eb\\n If the release is on the same first page of an eb, page lock would kick\\n in and prevent the race.\\n\\n- folio_detach_private() has a very small race window\\n It\u0027s only between folio_test_private() and folio_clear_private().\\n\\nThat\u0027s exactly when mapping-\u003ei_private_lock is used to prevent such race,\\nand commit 09e6cef19c9f (\\\"btrfs: refactor alloc_extent_buffer() to\\nallocate-then-attach method\\\") screwed that up.\\n\\nAt that time, I thought the page lock would kick in as\\nfilemap_release_folio() also requires the page to be locked, but forgot\\nthe filemap_release_folio() only locks one page, not all pages of an\\nextent buffer.\\n\\n[FIX]\\nMove all the code requiring i_private_lock into\\nattach_eb_folio_to_filemap(), so that everything is done with proper\\nlock protection.\\n\\nFurthermore to prevent future problems, add an extra\\nlockdep_assert_locked() to ensure we\u0027re holding the proper lock.\\n\\nTo reproducer that is able to hit the race (takes a few minutes with\\ninstrumented code inserting delays to alloc_extent_buffer()):\\n\\n #!/bin/sh\\n drop_caches () {\\n\\t while(true); do\\n\\t\\t echo 3 \u003e /proc/sys/vm/drop_caches\\n\\t\\t echo 1 \u003e /proc/sys/vm/compact_memory\\n\\t done\\n }\\n\\n run_tar () {\\n\\t while(true); do\\n\\t\\t for x in `seq 1 80` ; do\\n\\t\\t\\t tar cf /dev/zero /mnt \u003e /dev/null \u0026\\n\\t\\t done\\n\\t\\t wait\\n\\t done\\n }\\n\\n mkfs.btrfs -f -d single -m single\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/952f048eb901881a7cc6f7c1368b53cd386ead7b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3a5367c679d31473d3fbb391675055b4792c309\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.