CVE: CVE-2024-49932
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't readahead the relocation inode on RST

On relocation we're doing readahead on the relocation inode, but if the
filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to
preallocated extents not being mapped in the RST) from the lookup.

But readahead doesn't handle the error and submits invalid reads to the
device, causing an assertion in the scatter-gather list code:

  BTRFS info (device nvme1n1): balance: start -d -m -s
  BTRFS info (device nvme1n1): relocating block group[PII_REDACTED] flags data|raid0
  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [[PII_REDACTED],[PII_REDACTED]] devid 2, profile raid0
  ------------[ cut here ]------------
  kernel BUG at include/linux/scatterlist.h:115!
  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567
  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0
  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202
  RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: ffffea00045d4802
  RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8881027d1000
  RBP: [PII_REDACTED] R08: ffffea00045d4902 R09: [PII_REDACTED]
  R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff8881003d10b8
  R13: ffffc90001a438f0 R14: [PII_REDACTED] R15: [PII_REDACTED]
  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: 000000002cd11000 CR3:[PII_REDACTED]9ea001 CR4:[PII_REDACTED]370eb0
  Call Trace:
   <TASK>
   ? __die_body.cold+0x14/0x25
   ? die+0x2e/0x50
   ? do_trap+0xca/0x110
   ? do_error_trap+0x65/0x80
   ? __blk_rq_map_sg+0x339/0x4a0
   ? exc_invalid_op+0x50/0x70
   ? __blk_rq_map_sg+0x339/0x4a0
   ? asm_exc_invalid_op+0x1a/0x20
   ? __blk_rq_map_sg+0x339/0x4a0
   nvme_prep_rq.part.0+0x9d/0x770
   nvme_queue_rq+0x7d/0x1e0
   __blk_mq_issue_directly+0x2a/0x90
   ? blk_mq_get_budget_and_tag+0x61/0x90
   blk_mq_try_issue_list_directly+0x56/0xf0
   blk_mq_flush_plug_list.part.0+0x52b/0x5d0
   __blk_flush_plug+0xc6/0x110
   blk_finish_plug+0x28/0x40
   read_pages+0x160/0x1c0
   page_cache_ra_unbounded+0x109/0x180
   relocate_file_extent_cluster+0x611/0x6a0
   ? btrfs_search_slot+0xba4/0xd20
   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00
   relocate_data_extent.constprop.0+0x134/0x160
   relocate_block_group+0x3f2/0x500
   btrfs_relocate_block_group+0x250/0x430
   btrfs_relocate_chunk+0x3f/0x130
   btrfs_balance+0x71b/0xef0
   ? kmalloc_trace_noprof+0x13b/0x280
   btrfs_ioctl+0x2c2e/0x3030
   ? kvfree_call_rcu+0x1e6/0x340
   ? list_lru_add_obj+0x66/0x80
   ? mntput_no_expire+0x3a/0x220
   __x64_sys_ioctl+0x96/0xc0
   do_syscall_64+0x54/0x110
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  RIP: 0033:0x7fcc04514f9b
  Code: Unable to access opcode bytes at 0x7fcc04514f71.
  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: [PII_REDACTED]
  RAX: ffffffffffffffda RBX: [PII_REDACTED] RCX: 00007fcc04514f9b
  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: [PII_REDACTED]
  RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
  R10: 00007fcc043fbba8 R11: [PII_REDACTED] R12: 00007ffeba924fc5
  R13: 00007ffeba923460 R14: [PII_REDACTED] R15:[PII_REDACTED]4d4bb0
   </TASK>
  Modules linked in:
  ---[ end trace [PII_REDACTED] ]---
  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0
  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202
  RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: ffffea00045d4802
  RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8881027d1000
  RBP: [PII_REDACTED] R08: ffffea00045d4902 R09: [PII_REDACTED]
  R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff8881003d10b8
  R13: ffffc90001a438f0 R14: [PII_REDACTED] R15: [PII_REDACTED]
  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: 00007fcc04514f71 CR3:[PII_REDACTED]9ea001 CR4:[PII_REDACTED]370eb0
  Kernel p
---truncated---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/04915240e2c3a018e4c7f23418478d27226c8957; https://git.kernel.org/stable/c/f7a1218a983ab98aba140dc20b25f60b39ee4033