{"timestamp":"2024-04-03T18:10:16.242115Z","id":"CVE-2024-26726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"77cef2ec5484564eca6bd12a2b4a1e88fd766fbc","lessThan":"143842584c1237ebc248b2547c29d16bbe400a92","versionType":"git","status":"affected"},{"version":"77cef2ec5484564eca6bd12a2b4a1e88fd766fbc","lessThan":"02f2b95b00bf57d20320ee168b30fb7f3db8e555","versionType":"git","status":"affected"},{"version":"77cef2ec5484564eca6bd12a2b4a1e88fd766fbc","lessThan":"7bddf18f474f166c19f91b2baf67bf7c5eda03f7","versionType":"git","status":"affected"},{"version":"77cef2ec5484564eca6bd12a2b4a1e88fd766fbc","lessThan":"a4b7741c8302e28073bfc6dd1c2e73598e5e535e","versionType":"git","status":"affected"},{"version":"77cef2ec5484564eca6bd12a2b4a1e88fd766fbc","lessThan":"5571e41ec6e56e35f34ae9f5b3a335ef510e0ade","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","versionType":"semver","status":"unaffected"},{"version":"5.15.187","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.79","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","versionType":"semver","status":"unaffected"},{"version":"6.8","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://git.kernel.org/stable/c/143842584c1237ebc248b2547c29d16bbe400a92

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-617

OR
          *cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.6
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.18
          *cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.79

CVE: https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 Types: Patch

CVE: https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade Types: Patch

CVE: https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 Types: Patch

CVE: https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e Types: Patch

kernel.org: https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 Types: Patch

kernel.org: https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade Types: Patch

kernel.org: https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 Types: Patch

kernel.org: https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e Types: Patch

https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555

https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade

https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7

https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't drop extent_map for free space inode on write error

While running the CI for an unrelated change I hit the following panic
with generic/648 on btrfs_holes_spacecache.

assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1385!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1
RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0
Call Trace:
 <TASK>
 extent_write_cache_pages+0x2ac/0x8f0
 extent_writepages+0x87/0x110
 do_writepages+0xd5/0x1f0
 filemap_fdatawrite_wbc+0x63/0x90
 __filemap_fdatawrite_range+0x5c/0x80
 btrfs_fdatawrite_range+0x1f/0x50
 btrfs_write_out_cache+0x507/0x560
 btrfs_write_dirty_block_groups+0x32a/0x420
 commit_cowonly_roots+0x21b/0x290
 btrfs_commit_transaction+0x813/0x1360
 btrfs_sync_file+0x51a/0x640
 __x64_sys_fdatasync+0x52/0x90
 do_syscall_64+0x9c/0x190
 entry_SYSCALL_64_after_hwframe+0x6e/0x76

This happens because we fail to write out the free space cache in one
instance, come back around and attempt to write it again.  However on
the second pass through we go to call btrfs_get_extent() on the inode to
get the extent mapping.  Because this is a new block group, and with the
free space inode we always search the commit root to avoid deadlocking
with the tree, we find nothing and return a EXTENT_MAP_HOLE for the
requested range.

This happens because the first time we try to write the space cache out
we hit an error, and on an error we drop the extent mapping.  This is
normal for normal files, but the free space cache inode is special.  We
always expect the extent map to be correct.  Thus the second time
through we end up with a bogus extent map.

Since we're deprecating this feature, the most straightforward way to
fix this is to simply skip dropping the extent map range for this failed
range.

I shortened the test by using

kernel.org https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 [No types assigned]

kernel.org https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade [No types assigned]

kernel.org https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 [No types assigned]

kernel.org https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e [No types assigned]