CVE-2024-42266: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2024-42266

In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __extent_writepage fs/btrfs/extent_io.c:1597 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline] btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373 do_writepages+0x359/0x870 mm/page-writeback.c:2656 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] __filemap_fdatawrite mm/filemap.c:436 [inline] filemap_flush+0xdf/0x130 mm/filemap.c:463 btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:222 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:877 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f. I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design. I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack: folio_unlock+5 __process_pages_contig+475 cow_file_range_inline.constprop.0+230 cow_file_range+803 btrfs_run_delalloc_range+566 writepage_delalloc+332 __extent_writepage # inlined in my stacktrace, but I added it here extent_write_cache_pages+622 Looking at the bisected-to pa ---truncated---

AI Analysis

Technical Summary

CVE-2024-42266 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation. The issue arises in the buffered write path, specifically within the __extent_writepage() function, which handles writepage_delalloc() return values. When writepage_delalloc() returns 1, the function exits normally; however, for other return values, the code proceeds to call btrfs_folio_end_all_writers(). If the folio (a memory page structure) has been unlocked prematurely, this leads to an assertion failure and kernel panic. The root cause is that cow_file_range_inline() does not properly honor the locked_page state on error, resulting in an undesirable folio_unlock call during the writeback process. This flaw can cause the kernel to crash with an invalid opcode error, as demonstrated by syzbot fuzzing results and kernel oops logs. The vulnerability affects Linux kernel versions identified by the affected commit hashes and is related to the handling of copy-on-write operations in Btrfs during delayed allocation writes. Although no known exploits are reported in the wild, the issue can be triggered by workloads that generate IO errors or accelerated runs of specific test cases, potentially leading to denial of service (DoS) via kernel panic. The vulnerability does not appear to allow privilege escalation or arbitrary code execution directly but can cause system instability and data integrity risks due to unexpected kernel crashes during filesystem operations.

Potential Impact

For European organizations, the primary impact of CVE-2024-42266 is the risk of denial of service caused by kernel panics on systems using the Btrfs filesystem. This can lead to unplanned downtime, data loss, and disruption of critical services, especially in environments relying on Linux servers for storage and data management. Organizations using Btrfs for enterprise storage solutions, cloud infrastructure, or container environments may experience instability under certain workloads that trigger this bug. The vulnerability could affect data integrity indirectly if the system crashes during write operations, potentially leading to filesystem corruption or loss of recent data changes. Since Btrfs is popular in some Linux distributions used in Europe, including enterprise and cloud deployments, the impact could be significant in sectors such as finance, telecommunications, and public services where uptime and data reliability are critical. However, the lack of known exploits and the requirement for specific conditions to trigger the bug somewhat limit the immediate risk. Still, the vulnerability necessitates prompt patching to avoid service interruptions and maintain operational continuity.

Mitigation Recommendations

To mitigate CVE-2024-42266, European organizations should: 1) Apply the latest Linux kernel updates that include the patch fixing the cow_file_range_inline() handling and the related Btrfs writeback code. Monitoring vendor advisories and Linux distribution security updates is critical. 2) Temporarily avoid workloads that generate heavy IO errors or accelerated copy-on-write operations on Btrfs volumes until patched. 3) Implement robust monitoring of kernel logs and system stability to detect early signs of this issue, such as repeated kernel panics or Btrfs error messages. 4) Consider using alternative stable filesystems (e.g., ext4 or XFS) for critical systems if immediate patching is not feasible. 5) Maintain regular backups and snapshots of Btrfs volumes to minimize data loss risk in case of crashes. 6) Test kernel updates in staging environments to ensure compatibility and stability before deployment in production. These steps go beyond generic advice by focusing on workload adjustments, proactive monitoring, and filesystem choice to reduce exposure until patches are applied.