CVE-2024-49932

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't readahead the relocation inode on RST

On relocation we're doing readahead on the relocation inode, but if the filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to preallocated extents not being mapped in the RST) from the lookup.

But readahead doesn't handle the error and submits invalid reads to the device, causing an assertion in the scatter-gather list code:

BTRFS info (device nvme1n1): balance: start -d -m -s BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0 BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0 ------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:115! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567 RIP: 0010:blkrqmapsg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0 Call Trace: <TASK> ? _diebody.cold+0x14/0x25 ? die+0x2e/0x50 ? dotrap+0xca/0x110 ? doerrortrap+0x65/0x80 ? _blkrqmapsg+0x339/0x4a0 ? excinvalidop+0x50/0x70 ? _blkrqmapsg+0x339/0x4a0 ? asmexcinvalidop+0x1a/0x20 ? _blkrqmapsg+0x339/0x4a0 nvmepreprq.part.0+0x9d/0x770 nvmequeuerq+0x7d/0x1e0 _blkmqissuedirectly+0x2a/0x90 ? blkmqgetbudgetandtag+0x61/0x90 blkmqtryissuelistdirectly+0x56/0xf0 blkmqflushpluglist.part.0+0x52b/0x5d0 _blkflushplug+0xc6/0x110 blkfinishplug+0x28/0x40 readpages+0x160/0x1c0 pagecacheraunbounded+0x109/0x180 relocatefileextentcluster+0x611/0x6a0 ? btrfssearchslot+0xba4/0xd20 ? balancedirtypagesratelimitedflags+0x26/0xb00 relocatedataextent.constprop.0+0x134/0x160 relocateblockgroup+0x3f2/0x500 btrfsrelocateblockgroup+0x250/0x430 btrfsrelocatechunk+0x3f/0x130 btrfsbalance+0x71b/0xef0 ? kmalloctracenoprof+0x13b/0x280 btrfsioctl+0x2c2e/0x3030 ? kvfreecallrcu+0x1e6/0x340 ? listlruaddobj+0x66/0x80 ? mntputnoexpire+0x3a/0x220 _x64sysioctl+0x96/0xc0 dosyscall64+0x54/0x110 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fcc04514f9b Code: Unable to access opcode bytes at 0x7fcc04514f71. RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001 R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5 R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:blkrqmapsg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0 Kernel p ---truncated---