In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix quota root leak after quota disable failure
If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fsinfo->quotaroot is no longer pointing to the root (we have set it to NULL just before those steps).
Fix this by always doing a btrfsputroot() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and freeextentbuffer() calls on its root and commit root nodes, since back then roots were not yet reference counted.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd6a5b96157a21245566b21fd58276a214357ff",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-3a51b161",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"16471944435050565262307025648239314248",
"131424777200249493713884062619026199917",
"320131059942855641866783385432247065924",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94818bdb00ef34a996a06aa63d11f591074cb757",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-5b6c470f",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"314290182268549801239187302224761573742",
"62099102172081617934255842603093192073",
"155174945659246047013037070827562044257",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f88aeff5a173e8ba3133314eb4b964236ef3589d",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-5e1fa704",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"16471944435050565262307025648239314248",
"131424777200249493713884062619026199917",
"320131059942855641866783385432247065924",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7e4c6a3031c74078dba7fa36239d0f4fe476c53",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-726de217",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"16471944435050565262307025648239314248",
"131424777200249493713884062619026199917",
"320131059942855641866783385432247065924",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ef3961682e5310f2221bae99bcf9f5d0f4b0d51",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-74a55c21",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"16471944435050565262307025648239314248",
"131424777200249493713884062619026199917",
"320131059942855641866783385432247065924",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd6a5b96157a21245566b21fd58276a214357ff",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-758add76",
"digest": {
"length": 1587.0,
"function_hash": "88800617450842822161220110275035302423"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7e4c6a3031c74078dba7fa36239d0f4fe476c53",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-7a624774",
"digest": {
"length": 1587.0,
"function_hash": "88800617450842822161220110275035302423"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a69529f22590b67bb018de9acbcf94abc8603cf",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-81ccdf19",
"digest": {
"length": 1450.0,
"function_hash": "160854755505166009048531045965594415762"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ef3961682e5310f2221bae99bcf9f5d0f4b0d51",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-95b52320",
"digest": {
"length": 1505.0,
"function_hash": "65268591726984535705958114470936791833"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a69529f22590b67bb018de9acbcf94abc8603cf",
"signature_type": "Line",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-b039f158",
"digest": {
"line_hashes": [
"159864994709674869894333408538772358606",
"295291563000347129949397738118281008798",
"204353189205653446662688609790245647059",
"110911553538442082474582738035631444281",
"16471944435050565262307025648239314248",
"131424777200249493713884062619026199917",
"320131059942855641866783385432247065924",
"330517609782580897547694090396492922192",
"230042905911676813516311285704064686957"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94818bdb00ef34a996a06aa63d11f591074cb757",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-c272afb4",
"digest": {
"length": 1437.0,
"function_hash": "113430481677399455254221249770979483507"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f88aeff5a173e8ba3133314eb4b964236ef3589d",
"signature_type": "Function",
"target": {
"function": "btrfs_quota_disable",
"file": "fs/btrfs/qgroup.c"
},
"id": "CVE-2024-41078-d5125997",
"digest": {
"length": 1511.0,
"function_hash": "27774663680555582865488846361979541887"
},
"deprecated": false
}
]