CVE-2024-37354
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-37354
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-37354.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-37354
- Downstream
- Related
- Published
- 2024-06-25T14:22:36Z
- Modified
- 2025-10-17T07:09:55.129984Z
- Summary
- btrfs: fix crash on racing fsync and size-extending write into prealloc
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix crash on racing fsync and size-extending write into prealloc
We have been seeing crashes on duplicate keys in btrfssetitemkeysafe():
BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192) ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.c:2620! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 3139 Comm: xfsio Kdump: loaded Not tainted 6.9.0 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:btrfssetitemkey_safe+0x11f/0x290 [btrfs]
With the following stack trace:
#0 btrfssetitemkeysafe (fs/btrfs/ctree.c:2620:4) #1 btrfsdropextents (fs/btrfs/file.c:411:4) #2 logoneextent (fs/btrfs/tree-log.c:4732:9) #3 btrfslogchangedextents (fs/btrfs/tree-log.c:4955:9) #4 btrfsloginode (fs/btrfs/tree-log.c:6626:9) #5 btrfsloginodeparent (fs/btrfs/tree-log.c:7070:8) #6 btrfslogdentrysafe (fs/btrfs/tree-log.c:7171:8) #7 btrfssyncfile (fs/btrfs/file.c:1933:8) #8 vfsfsyncrange (fs/sync.c:188:9) #9 vfsfsync (fs/sync.c:202:9) #10 dofsync (fs/sync.c:212:9) #11 _dosysfdatasync (fs/sync.c:225:9) #12 _sesysfdatasync (fs/sync.c:223:1) #13 _x64sysfdatasync (fs/sync.c:223:1) #14 dosyscallx64 (arch/x86/entry/common.c:52:14) #15 dosyscall64 (arch/x86/entry/common.c:83:7) #16 entrySYSCALL64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)
So we're logging a changed extent from fsync, which is splitting an extent in the log tree. But this split part already exists in the tree, triggering the BUG().
This is the state of the log tree at the time of the crash, dumped with drgn (https://github.com/osandov/drgn/blob/main/contrib/btrfstree.py) to get more details than btrfsprint_leaf() gives us:
printextentbuffer(prog.crashedthread().stacktrace()[0]["eb"]) leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610 leaf 33439744 flags 0x100000000000000 fs uuid e5bd3946-400c-4223-8923-190ef1f18677 chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da item 0 key (450 INODEITEM 0) itemoff 16123 itemsize 160 generation 7 transid 9 size 8192 nbytes 8473563889606862198 block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0 sequence 204 flags 0x10(PREALLOC) atime 1716417703.220000000 (2024-05-22 15:41:43) ctime 1716417704.983333333 (2024-05-22 15:41:44) mtime 1716417704.983333333 (2024-05-22 15:41:44) otime 17592186044416.000000000 (559444-03-08 01:40:16) item 1 key (450 INODEREF 256) itemoff 16110 itemsize 13 index 195 namelen 3 name: 193 item 2 key (450 XATTRITEM 1640047104) itemoff 16073 itemsize 37 location key (0 UNKNOWN.0 0) type XATTR transid 7 datalen 1 namelen 6 name: user.a data a item 3 key (450 EXTENTDATA 0) itemoff 16020 itemsize 53 generation 9 type 1 (regular) extent data disk byte 303144960 nr 12288 extent data offset 0 nr 4096 ram 12288 extent compression 0 (none) item 4 key (450 EXTENTDATA 4096) itemoff 15967 itemsize 53 generation 9 type 2 (prealloc) prealloc data disk byte 303144960 nr 12288 prealloc data offset 4096 nr 8192 item 5 key (450 EXTENTDATA 8192) itemoff 15914 itemsize 53 generation 9 type 2 (prealloc) prealloc data disk byte 303144960 nr 12288 prealloc data offset 8192 nr 4096 ...
So the real problem happened earlier: notice that items 4 (4k-12k) and 5 (8k-12k) overlap. Both are prealloc extents. Item 4 straddles isize and item 5 starts at isize.
Here is the state of ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428
- https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097
- https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b
- https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed1ff2bd566fbcefcb892be85c493bdb92b911c428
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed3d08c52ba1887a1ff9c179d4b6a18b427bcb2097
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixedf4e5ed974876c14d3623e04dc43d3e3281bc6011
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed9d274c19a71b3a276949933859610721a453946b
Affected versions
v2.*
v3.*
v4.*
v5.*
v6.*
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d08c52ba1887a1ff9c179d4b6a18b427bcb2097",
"signature_version": "v1",
"target": {
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101110393072182413393038189428543849884",
"210319828712961697184226192276100440040",
"50238007602881130607229669630047938928",
"208254361341079346219275860285634206061",
"71142008843925079375323667445727252750",
"171948690785677283297075377027233900710",
"84715785904085996353632868952545407808",
"200346259429049377469712524015010180110",
"222526772025885678541288583539403212890",
"67727495876904998675240510751366519726",
"201717971542745665338496356283646361203"
]
},
"id": "CVE-2024-37354-002f76e5"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4e5ed974876c14d3623e04dc43d3e3281bc6011",
"signature_version": "v1",
"target": {
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101110393072182413393038189428543849884",
"210319828712961697184226192276100440040",
"50238007602881130607229669630047938928",
"208254361341079346219275860285634206061",
"71142008843925079375323667445727252750",
"171948690785677283297075377027233900710",
"84715785904085996353632868952545407808",
"200346259429049377469712524015010180110",
"222526772025885678541288583539403212890",
"67727495876904998675240510751366519726",
"201717971542745665338496356283646361203"
]
},
"id": "CVE-2024-37354-37b45355"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d274c19a71b3a276949933859610721a453946b",
"signature_version": "v1",
"target": {
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101110393072182413393038189428543849884",
"210319828712961697184226192276100440040",
"50238007602881130607229669630047938928",
"208254361341079346219275860285634206061",
"71142008843925079375323667445727252750",
"171948690785677283297075377027233900710",
"84715785904085996353632868952545407808",
"200346259429049377469712524015010180110",
"222526772025885678541288583539403212890",
"67727495876904998675240510751366519726",
"201717971542745665338496356283646361203"
]
},
"id": "CVE-2024-37354-5aa7499f"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d274c19a71b3a276949933859610721a453946b",
"signature_version": "v1",
"target": {
"function": "btrfs_log_prealloc_extents",
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"function_hash": "316315077138489926276252263038782172824",
"length": 2002.0
},
"id": "CVE-2024-37354-9b9d1add"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d08c52ba1887a1ff9c179d4b6a18b427bcb2097",
"signature_version": "v1",
"target": {
"function": "btrfs_log_prealloc_extents",
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"function_hash": "120859719151999552314511871759123867253",
"length": 1970.0
},
"id": "CVE-2024-37354-af427ba0"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ff2bd566fbcefcb892be85c493bdb92b911c428",
"signature_version": "v1",
"target": {
"function": "btrfs_log_prealloc_extents",
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"function_hash": "120859719151999552314511871759123867253",
"length": 1970.0
},
"id": "CVE-2024-37354-b971c35a"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4e5ed974876c14d3623e04dc43d3e3281bc6011",
"signature_version": "v1",
"target": {
"function": "btrfs_log_prealloc_extents",
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"function_hash": "316315077138489926276252263038782172824",
"length": 2002.0
},
"id": "CVE-2024-37354-d28a1b61"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ff2bd566fbcefcb892be85c493bdb92b911c428",
"signature_version": "v1",
"target": {
"file": "fs/btrfs/tree-log.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"101110393072182413393038189428543849884",
"210319828712961697184226192276100440040",
"50238007602881130607229669630047938928",
"208254361341079346219275860285634206061",
"71142008843925079375323667445727252750",
"171948690785677283297075377027233900710",
"84715785904085996353632868952545407808",
"200346259429049377469712524015010180110",
"222526772025885678541288583539403212890",
"67727495876904998675240510751366519726",
"201717971542745665338496356283646361203"
]
},
"id": "CVE-2024-37354-d7996800"
}
]