CVE-2024-57975

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: do proper folio cleanup when run_delalloc_nocow() failed<br /> <br /> [BUG]<br /> With CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash<br /> with the following VM_BUG_ON_FOLIO():<br /> <br /> BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28<br /> BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28<br /> page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664<br /> aops:btrfs_aops [btrfs] ino:101 dentry name(?):"f1774"<br /> flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)<br /> page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))<br /> ------------[ cut here ]------------<br /> kernel BUG at mm/page-writeback.c:2992!<br /> Internal error: Oops - BUG: 00000000f2000800 [#1] SMP<br /> CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G OE 6.12.0-rc7-custom+ #87<br /> Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE<br /> Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022<br /> Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]<br /> pc : folio_clear_dirty_for_io+0x128/0x258<br /> lr : folio_clear_dirty_for_io+0x128/0x258<br /> Call trace:<br /> folio_clear_dirty_for_io+0x128/0x258<br /> btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]<br /> __process_folios_contig+0x154/0x268 [btrfs]<br /> extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]<br /> run_delalloc_nocow+0x5f8/0x760 [btrfs]<br /> btrfs_run_delalloc_range+0xa8/0x220 [btrfs]<br /> writepage_delalloc+0x230/0x4c8 [btrfs]<br /> extent_writepage+0xb8/0x358 [btrfs]<br /> extent_write_cache_pages+0x21c/0x4e8 [btrfs]<br /> btrfs_writepages+0x94/0x150 [btrfs]<br /> do_writepages+0x74/0x190<br /> filemap_fdatawrite_wbc+0x88/0xc8<br /> start_delalloc_inodes+0x178/0x3a8 [btrfs]<br /> btrfs_start_delalloc_roots+0x174/0x280 [btrfs]<br /> shrink_delalloc+0x114/0x280 [btrfs]<br /> flush_space+0x250/0x2f8 [btrfs]<br /> btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]<br /> process_one_work+0x164/0x408<br /> worker_thread+0x25c/0x388<br /> kthread+0x100/0x118<br /> ret_from_fork+0x10/0x20<br /> Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)<br /> ---[ end trace 0000000000000000 ]---<br /> <br /> [CAUSE]<br /> The first two lines of extra debug messages show the problem is caused<br /> by the error handling of run_delalloc_nocow().<br /> <br /> E.g. we have the following dirtied range (4K blocksize 4K page size):<br /> <br /> 0 16K 32K<br /> |//////////////////////////////////////|<br /> | Pre-allocated |<br /> <br /> And the range [0, 16K) has a preallocated extent.<br /> <br /> - Enter run_delalloc_nocow() for range [0, 16K)<br /> Which found range [0, 16K) is preallocated, can do the proper NOCOW<br /> write.<br /> <br /> - Enter fallback_to_fow() for range [16K, 32K)<br /> Since the range [16K, 32K) is not backed by preallocated extent, we<br /> have to go COW.<br /> <br /> - cow_file_range() failed for range [16K, 32K)<br /> So cow_file_range() will do the clean up by clearing folio dirty,<br /> unlock the folios.<br /> <br /> Now the folios in range [16K, 32K) is unlocked.<br /> <br /> - Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()<br /> Which is called with PAGE_START_WRITEBACK to start page writeback.<br /> But folios can only be marked writeback when it&amp;#39;s properly locked,<br /> thus this triggered the VM_BUG_ON_FOLIO().<br /> <br /> Furthermore there is another hidden but common bug that<br /> run_delalloc_nocow() is not clearing the folio dirty flags in its error<br /> handling path.<br /> This is the common bug shared between run_delalloc_nocow() and<br /> cow_file_range().<br /> <br /> [FIX]<br /> - Clear folio dirty for range [@start, @cur_offset)<br /> Introduce a helper, cleanup_dirty_folios(), which<br /> will find and lock the folio in the range, clear the dirty flag and<br /> start/end the writeback, with the extra handling for the<br /> @locked_folio.<br /> <br /> - Introduce a helper to clear folio dirty, start and end writeback<br /> <br /> - Introduce a helper to record the last failed COW range end<br /> This is to trace which range we should skip, to avoid double<br /> unlocking.<br /> <br /> - Skip the failed COW range for the e<br /> ---truncated---