linux-kernel - [PATCH AUTOSEL 6.15 5/9] btrfs: exit after state split error at set_extent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250528215559.1983214-5-sashal@kernel.org>
Date: Wed, 28 May 2025 17:55:55 -0400
From: Sasha Levin <sashal@...nel.org>
To: patches@...ts.linux.dev,
	stable@...r.kernel.org
Cc: Filipe Manana <fdmanana@...e.com>,
	David Sterba <dsterba@...e.com>,
	Sasha Levin <sashal@...nel.org>,
	clm@...com,
	josef@...icpanda.com,
	linux-btrfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH AUTOSEL 6.15 5/9] btrfs: exit after state split error at set_extent_bit()

From: Filipe Manana <fdmanana@...e.com>

[ Upstream commit 41d69d4d78d8b179bf3bcdfc56d28a12b3a608d2 ]

If split_state() returned an error we call extent_io_tree_panic() which
will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an
uncommon and exotic scenario, then we fallthrough and hit a use after free
when calling set_state_bits() since the extent state record which the
local variable 'prealloc' points to was freed by split_state().

So jump to the label 'out' after calling extent_io_tree_panic() and set
the 'prealloc' pointer to NULL since split_state() has already freed it
when it hit an error.

Signed-off-by: Filipe Manana <fdmanana@...e.com>
Reviewed-by: David Sterba <dsterba@...e.com>
Signed-off-by: David Sterba <dsterba@...e.com>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---

**YES** This commit should be backported to stable kernel trees. Here's
my extensive analysis: ## Analysis of the Code Changes The commit fixes
a critical use-after-free bug in the btrfs filesystem's extent I/O tree
management. Examining the specific code changes: **Problem Location**:
In `fs/btrfs/extent-io-tree.c`, function `set_extent_bit()` around lines
1254-1256: ```c ret = split_state(tree, state, prealloc, end + 1); if
(ret) extent_io_tree_panic(tree, state, "split", ret); ``` **The Bug**:
After `split_state()` fails and `extent_io_tree_panic()` is called, the
code continues to execute `set_state_bits(tree, prealloc, bits,
changeset)` on line 1258. However, when `split_state()` fails, it frees
the `prealloc` extent state, making this a use-after-free vulnerability.
**The Fix**: The commit adds proper error handling: ```c ret =
split_state(tree, state, prealloc, end + 1); if (ret) {
extent_io_tree_panic(tree, state, "split", ret); prealloc = NULL; goto
out; } ``` ## Why This Should Be Backported ### 1. **Critical Security
Issue** - **Use-after-free vulnerability**: This is a serious memory
safety issue that can lead to kernel crashes, data corruption, or
potentially exploitable conditions - **Affects btrfs filesystem**: A
widely used filesystem in production environments ### 2. **Specific Edge
Case Scenario** From my examination of the kernel code: -
`extent_io_tree_panic()` calls `btrfs_panic()` which calls `BUG()` -
When `CONFIG_BUG` is disabled (uncommon but possible), `BUG()` becomes a
no-op loop instead of halting execution - This allows execution to
continue to the use-after-free code ### 3. **Minimal Risk Change** -
**Small, targeted fix**: Only adds 3 lines of code - **Clear logic**:
Sets pointer to NULL and jumps to cleanup - **No functional changes**:
Doesn't alter normal operation paths - **No architectural changes**:
Pure bug fix without affecting subsystem design ### 4. **Comparison with
Similar Commits** Looking at the reference commits: - Similar to
"Similar Commit #2" (marked YES) which also improved error handling in
extent bit operations - Unlike commits marked NO, this doesn't add
features or make architectural changes - Follows the same pattern as
other accepted backports for memory safety fixes ### 5. **Clear Bug Fix
Criteria** - **Fixes a real bug**: Use-after-free is a concrete,
exploitable issue - **Minimal scope**: Only affects error path in one
function - **No side effects**: Change only affects already-failing code
paths - **Well-understood impact**: Risk is contained to btrfs extent
I/O operations ### 6. **Production Impact** - While `CONFIG_BUG` being
disabled is rare, when it occurs this creates a serious vulnerability -
btrfs is used in production environments where memory safety is critical
- The fix prevents potential kernel crashes or memory corruption ### 7.
**Stable Tree Compatibility** - **Self-contained**: Doesn't depend on
other recent changes - **Backwards compatible**: No API changes - **Low
regression risk**: Only affects error handling path that was already
broken The commit perfectly fits stable tree criteria: it's a small,
important bugfix with minimal risk that addresses a real security issue
in a widely-used filesystem.

 fs/btrfs/extent-io-tree.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c
index 92cfde37b1d33..b5b44ea91f999 100644
--- a/fs/btrfs/extent-io-tree.c
+++ b/fs/btrfs/extent-io-tree.c
@@ -1252,8 +1252,11 @@ static int __set_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
 		if (!prealloc)
 			goto search_again;
 		ret = split_state(tree, state, prealloc, end + 1);
-		if (ret)
+		if (ret) {
 			extent_io_tree_panic(tree, state, "split", ret);
+			prealloc = NULL;
+			goto out;
+		}
 
 		set_state_bits(tree, prealloc, bits, changeset);
 		cache_state(prealloc, cached_state);
-- 
2.39.5