CVE-2024-57806

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-57806
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-57806.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-57806
Related
Published
2025-01-11T13:15:30Z
Modified
2025-01-16T05:49:18.673125Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix transaction atomicity bug when enabling simple quotas

Set squota incompat bit before committing the transaction that enables the feature.

With the config CONFIGBTRFSASSERT enabled, an assertion failure occurs regarding the simple quota feature.

[5.596534] assertion failed: btrfsfsincompat(fsinfo, SIMPLEQUOTA), in fs/btrfs/qgroup.c:365 [5.597098] ------------[ cut here ]------------ [5.597371] kernel BUG at fs/btrfs/qgroup.c:365! [5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146 [5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [5.599008] RIP: 0010:btrfsreadqgroupconfig+0x74d/0x7a0 [5.604303] <TASK> [5.605230] ? btrfsreadqgroupconfig+0x74d/0x7a0 [5.605538] ? excinvalidop+0x56/0x70 [5.605775] ? btrfsreadqgroupconfig+0x74d/0x7a0 [5.606066] ? asmexcinvalidop+0x1f/0x30 [5.606441] ? btrfsreadqgroupconfig+0x74d/0x7a0 [5.606741] ? btrfsreadqgroupconfig+0x74d/0x7a0 [5.607038] ? trytowakeup+0x317/0x760 [5.607286] openctree+0xd9c/0x1710 [5.607509] btrfsgettree+0x58a/0x7e0 [5.608002] vfsgettree+0x2e/0x100 [5.608224] fcmount+0x16/0x60 [5.608420] btrfsgettree+0x2f8/0x7e0 [5.608897] vfsgettree+0x2e/0x100 [5.609121] pathmount+0x4c8/0xbc0 [5.609538] _x64sys_mount+0x10d/0x150

The issue can be easily reproduced using the following reproducer:

root@q:linux# cat repro.sh set -e

mkfs.btrfs -q -f /dev/sdb mount /dev/sdb /mnt/btrfs btrfs quota enable -s /mnt/btrfs umount /mnt/btrfs mount /dev/sdb /mnt/btrfs

The issue is that when enabling quotas, at btrfsquotaenable(), we set BTRFSQGROUPSTATUSFLAGSIMPLEMODE at fsinfo->qgroupflags and persist it in the quota root in the item with the key BTRFSQGROUPSTATUSKEY, but we only set the incompat bit BTRFSFEATUREINCOMPATSIMPLEQUOTA after we commit the transaction used to enable simple quotas.

This means that if after that transaction commit we unmount the filesystem without starting and committing any other transaction, or we have a power failure, the next time we mount the filesystem we will find the flag BTRFSQGROUPSTATUSFLAGSIMPLEMODE set in the item with the key BTRFSQGROUPSTATUSKEY but we will not find the incompat bit BTRFSFEATUREINCOMPATSIMPLEQUOTA set in the superblock, triggering an assertion failure at:

btrfsreadqgroupconfig() -> qgroupreadenablegen()

To fix this issue, set the BTRFSFEATUREINCOMPATSIMPLEQUOTA flag immediately after setting the BTRFSQGROUPSTATUSFLAGSIMPLE_MODE. This ensures that both flags are flushed to disk within the same transaction.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.8-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}