CVE-2024-42266

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make cowfilerangeinline() honor lockedpage on error

The btrfs buffered write path runs through _extentwritepage() which has some tricky return value handling for writepagedelalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfsfolioendallwriters(). If the folio has been unlocked (note that we check the PageLocked bit at the start of _extent_writepage()), this results in an assert panic like this one from syzbot:

BTRFS: error (device loop0 state EAL) in freelogtree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanuptransaction:2018: errno=-5 IO failure assertion failed: foliotestlocked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfsfolioendallwriters+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> _extentwritepage fs/btrfs/extentio.c:1597 [inline] extentwritecachepages fs/btrfs/extentio.c:2251 [inline] btrfswritepages+0x14d7/0x2760 fs/btrfs/extentio.c:2373 dowritepages+0x359/0x870 mm/page-writeback.c:2656 filemapfdatawritewbc+0x125/0x180 mm/filemap.c:397 _filemapfdatawriterange mm/filemap.c:430 [inline] _filemapfdatawrite mm/filemap.c:436 [inline] filemapflush+0xdf/0x130 mm/filemap.c:463 btrfsreleasefile+0x117/0x130 fs/btrfs/file.c:1547 _fput+0x24a/0x8a0 fs/filetable.c:422 taskworkrun+0x24f/0x310 kernel/taskwork.c:222 exittaskwork include/linux/taskwork.h:40 [inline] doexit+0xa2f/0x27f0 kernel/exit.c:877 dogroupexit+0x207/0x2c0 kernel/exit.c:1026 _dosysexitgroup kernel/exit.c:1037 [inline] _sesysexitgroup kernel/exit.c:1035 [inline] _x64sysexitgroup+0x3f/0x40 kernel/exit.c:1035 x64syscall+0x2634/0x2640 arch/x86/include/generated/asm/syscalls64.h:232 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f.

I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design.

I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack:

foliounlock+5 _processpagescontig+475 cowfilerangeinline.constprop.0+230 cowfilerange+803 btrfsrundelallocrange+566 writepagedelalloc+332 _extentwritepage # inlined in my stacktrace, but I added it here extentwritecachepages+622

Looking at the bisected-to pa ---truncated---