cve-2024-49932
Vulnerability from cvelistv5
Published
2024-10-21 18:01
Modified
2025-05-04 09:41
Severity ?
EPSS score ?
0.01% (0.01387)
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't readahead the relocation inode on RST On relocation we're doing readahead on the relocation inode, but if the filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to preallocated extents not being mapped in the RST) from the lookup. But readahead doesn't handle the error and submits invalid reads to the device, causing an assertion in the scatter-gather list code: BTRFS info (device nvme1n1): balance: start -d -m -s BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0 BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0 ------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:115! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567 RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die_body.cold+0x14/0x25 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? __blk_rq_map_sg+0x339/0x4a0 ? exc_invalid_op+0x50/0x70 ? __blk_rq_map_sg+0x339/0x4a0 ? asm_exc_invalid_op+0x1a/0x20 ? __blk_rq_map_sg+0x339/0x4a0 nvme_prep_rq.part.0+0x9d/0x770 nvme_queue_rq+0x7d/0x1e0 __blk_mq_issue_directly+0x2a/0x90 ? blk_mq_get_budget_and_tag+0x61/0x90 blk_mq_try_issue_list_directly+0x56/0xf0 blk_mq_flush_plug_list.part.0+0x52b/0x5d0 __blk_flush_plug+0xc6/0x110 blk_finish_plug+0x28/0x40 read_pages+0x160/0x1c0 page_cache_ra_unbounded+0x109/0x180 relocate_file_extent_cluster+0x611/0x6a0 ? btrfs_search_slot+0xba4/0xd20 ? balance_dirty_pages_ratelimited_flags+0x26/0xb00 relocate_data_extent.constprop.0+0x134/0x160 relocate_block_group+0x3f2/0x500 btrfs_relocate_block_group+0x250/0x430 btrfs_relocate_chunk+0x3f/0x130 btrfs_balance+0x71b/0xef0 ? kmalloc_trace_noprof+0x13b/0x280 btrfs_ioctl+0x2c2e/0x3030 ? kvfree_call_rcu+0x1e6/0x340 ? list_lru_add_obj+0x66/0x80 ? mntput_no_expire+0x3a/0x220 __x64_sys_ioctl+0x96/0xc0 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fcc04514f9b Code: Unable to access opcode bytes at 0x7fcc04514f71. RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001 R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5 R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0 Kernel p ---truncated---
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website


{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-49932",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T13:38:55.739615Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T13:48:43.075Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "fs/btrfs/relocation.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "f7a1218a983ab98aba140dc20b25f60b39ee4033",
                     status: "affected",
                     version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                     versionType: "git",
                  },
                  {
                     lessThan: "04915240e2c3a018e4c7f23418478d27226c8957",
                     status: "affected",
                     version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "fs/btrfs/relocation.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.3",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.12",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         cpeApplicability: [
            {
               nodes: [
                  {
                     cpeMatch: [
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.11.3",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.12",
                           vulnerable: true,
                        },
                     ],
                     negate: false,
                     operator: "OR",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n  BTRFS info (device nvme1n1): balance: start -d -m -s\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/scatterlist.h:115!\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Call Trace:\n   <TASK>\n   ? __die_body.cold+0x14/0x25\n   ? die+0x2e/0x50\n   ? do_trap+0xca/0x110\n   ? do_error_trap+0x65/0x80\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? exc_invalid_op+0x50/0x70\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? __blk_rq_map_sg+0x339/0x4a0\n   nvme_prep_rq.part.0+0x9d/0x770\n   nvme_queue_rq+0x7d/0x1e0\n   __blk_mq_issue_directly+0x2a/0x90\n   ? blk_mq_get_budget_and_tag+0x61/0x90\n   blk_mq_try_issue_list_directly+0x56/0xf0\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n   __blk_flush_plug+0xc6/0x110\n   blk_finish_plug+0x28/0x40\n   read_pages+0x160/0x1c0\n   page_cache_ra_unbounded+0x109/0x180\n   relocate_file_extent_cluster+0x611/0x6a0\n   ? btrfs_search_slot+0xba4/0xd20\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n   relocate_data_extent.constprop.0+0x134/0x160\n   relocate_block_group+0x3f2/0x500\n   btrfs_relocate_block_group+0x250/0x430\n   btrfs_relocate_chunk+0x3f/0x130\n   btrfs_balance+0x71b/0xef0\n   ? kmalloc_trace_noprof+0x13b/0x280\n   btrfs_ioctl+0x2c2e/0x3030\n   ? kvfree_call_rcu+0x1e6/0x340\n   ? list_lru_add_obj+0x66/0x80\n   ? mntput_no_expire+0x3a/0x220\n   __x64_sys_ioctl+0x96/0xc0\n   do_syscall_64+0x54/0x110\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7fcc04514f9b\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n   </TASK>\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Kernel p\n---truncated---",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-05-04T09:41:39.407Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/f7a1218a983ab98aba140dc20b25f60b39ee4033",
            },
            {
               url: "https://git.kernel.org/stable/c/04915240e2c3a018e4c7f23418478d27226c8957",
            },
         ],
         title: "btrfs: don't readahead the relocation inode on RST",
         x_generator: {
            engine: "bippy-1.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-49932",
      datePublished: "2024-10-21T18:01:54.410Z",
      dateReserved: "2024-10-21T12:17:06.040Z",
      dateUpdated: "2025-05-04T09:41:39.407Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-49932\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:15.140\",\"lastModified\":\"2024-11-13T15:01:49.790\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: don't readahead the relocation inode on RST\\n\\nOn relocation we're doing readahead on the relocation inode, but if the\\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\\npreallocated extents not being mapped in the RST) from the lookup.\\n\\nBut readahead doesn't handle the error and submits invalid reads to the\\ndevice, causing an assertion in the scatter-gather list code:\\n\\n  BTRFS info (device nvme1n1): balance: start -d -m -s\\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\\n  ------------[ cut here ]------------\\n  kernel BUG at include/linux/scatterlist.h:115!\\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\\n  Call Trace:\\n   <TASK>\\n   ? __die_body.cold+0x14/0x25\\n   ? die+0x2e/0x50\\n   ? do_trap+0xca/0x110\\n   ? do_error_trap+0x65/0x80\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   ? exc_invalid_op+0x50/0x70\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   ? asm_exc_invalid_op+0x1a/0x20\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   nvme_prep_rq.part.0+0x9d/0x770\\n   nvme_queue_rq+0x7d/0x1e0\\n   __blk_mq_issue_directly+0x2a/0x90\\n   ? blk_mq_get_budget_and_tag+0x61/0x90\\n   blk_mq_try_issue_list_directly+0x56/0xf0\\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\\n   __blk_flush_plug+0xc6/0x110\\n   blk_finish_plug+0x28/0x40\\n   read_pages+0x160/0x1c0\\n   page_cache_ra_unbounded+0x109/0x180\\n   relocate_file_extent_cluster+0x611/0x6a0\\n   ? btrfs_search_slot+0xba4/0xd20\\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\\n   relocate_data_extent.constprop.0+0x134/0x160\\n   relocate_block_group+0x3f2/0x500\\n   btrfs_relocate_block_group+0x250/0x430\\n   btrfs_relocate_chunk+0x3f/0x130\\n   btrfs_balance+0x71b/0xef0\\n   ? kmalloc_trace_noprof+0x13b/0x280\\n   btrfs_ioctl+0x2c2e/0x3030\\n   ? kvfree_call_rcu+0x1e6/0x340\\n   ? list_lru_add_obj+0x66/0x80\\n   ? mntput_no_expire+0x3a/0x220\\n   __x64_sys_ioctl+0x96/0xc0\\n   do_syscall_64+0x54/0x110\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n  RIP: 0033:0x7fcc04514f9b\\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\\n   </TASK>\\n  Modules linked in:\\n  ---[ end trace 0000000000000000 ]---\\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\\n  Kernel p\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: no leer con anticipación el inodo de reubicación en RST En la reubicación, hacemos lectura anticipada en el inodo de reubicación, pero si el sistema de archivos está respaldado por un árbol de bandas RAID, podemos obtener ENOENT (por ejemplo, debido a que las extensiones preasignadas no se asignan en el RST) a partir de la búsqueda. Pero readahead no maneja el error y envía lecturas no válidas al dispositivo, lo que causa una afirmación en el código de la lista scatter-gather: BTRFS info (device nvme1n1): balance: start -d -m -s BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0 BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0 ------------[ cortar aquí ]------------ ¡ERROR del kernel en include/linux/scatterlist.h:115! Ups: código de operación no válido: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 1012 Comm: btrfs No contaminado 6.10.0-rc7+ #567 RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 000000000000000 RBX: 000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0 Seguimiento de llamadas:  ? __die_body.cold+0x14/0x25 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? __blk_rq_map_sg+0x339/0x4a0 ? exc_invalid_op+0x50/0x70 ? __blk_rq_map_sg+0x339/0x4a0 ? asm_exc_invalid_op+0x1a/0x20 ? __blk_rq_map_sg+0x339/0x4a0 nvme_prep_rq.part.0+0x9d/0x770 nvme_queue_rq+0x7d/0x1e0 __blk_mq_issue_directly+0x2a/0x90 ? blk_mq_get_budget_and_tag+0x61/0x90 blk_mq_try_issue_list_directly+0x56/0xf0 blk_mq_flush_plug_list.part.0+0x52b/0x5d0 __blk_flush_plug+0xc6/0x110 blk_finish_plug+0x28/0x40 read_pages+0x160/0x1c0 page_cache_ra_unbounded+0x109/0x180 relocate_file_extent_cluster+0x611/0x6a0 ? btrfs_search_slot+0xba4/0xd20 ? balance_dirty_pages_ratelimited_flags+0x26/0xb00 relocate_data_extent.constprop.0+0x134/0x160 relocate_block_group+0x3f2/0x500 btrfs_relocate_block_group+0x250/0x430 btrfs_relocate_chunk+0x3f/0x130 btrfs_balance+0x71b/0xef0 ? kmalloc_trace_noprof+0x13b/0x280 btrfs_ioctl+0x2c2e/0x3030 ? kvfree_call_rcu+0x1e6/0x340 ? list_lru_add_obj+0x66/0x80 ? mntput_no_expire+0x3a/0x220 __x64_sys_ioctl+0x96/0xc0 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fcc04514f9b Código: No se puede acceder a los bytes del código de operación en 0x7fcc04514f71. RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003 RBP: 000000000000000 R08: 0000000000000013 R09: 0000000000000001 R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5 R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0  Módulos vinculados en: ---[ fin del seguimiento 000000000000000 ]--- RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 00000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0 Núcleo p ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04915240e2c3a018e4c7f23418478d27226c8957\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7a1218a983ab98aba140dc20b25f60b39ee4033\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49932\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:38:55.739615Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:38:58.934Z\"}}], \"cna\": {\"title\": \"btrfs: don't readahead the relocation inode on RST\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"f7a1218a983a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"04915240e2c3\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/relocation.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12-rc1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/relocation.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f7a1218a983ab98aba140dc20b25f60b39ee4033\"}, {\"url\": \"https://git.kernel.org/stable/c/04915240e2c3a018e4c7f23418478d27226c8957\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: don't readahead the relocation inode on RST\\n\\nOn relocation we're doing readahead on the relocation inode, but if the\\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\\npreallocated extents not being mapped in the RST) from the lookup.\\n\\nBut readahead doesn't handle the error and submits invalid reads to the\\ndevice, causing an assertion in the scatter-gather list code:\\n\\n  BTRFS info (device nvme1n1): balance: start -d -m -s\\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\\n  ------------[ cut here ]------------\\n  kernel BUG at include/linux/scatterlist.h:115!\\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\\n  Call Trace:\\n   <TASK>\\n   ? __die_body.cold+0x14/0x25\\n   ? die+0x2e/0x50\\n   ? do_trap+0xca/0x110\\n   ? do_error_trap+0x65/0x80\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   ? exc_invalid_op+0x50/0x70\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   ? asm_exc_invalid_op+0x1a/0x20\\n   ? __blk_rq_map_sg+0x339/0x4a0\\n   nvme_prep_rq.part.0+0x9d/0x770\\n   nvme_queue_rq+0x7d/0x1e0\\n   __blk_mq_issue_directly+0x2a/0x90\\n   ? blk_mq_get_budget_and_tag+0x61/0x90\\n   blk_mq_try_issue_list_directly+0x56/0xf0\\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\\n   __blk_flush_plug+0xc6/0x110\\n   blk_finish_plug+0x28/0x40\\n   read_pages+0x160/0x1c0\\n   page_cache_ra_unbounded+0x109/0x180\\n   relocate_file_extent_cluster+0x611/0x6a0\\n   ? btrfs_search_slot+0xba4/0xd20\\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\\n   relocate_data_extent.constprop.0+0x134/0x160\\n   relocate_block_group+0x3f2/0x500\\n   btrfs_relocate_block_group+0x250/0x430\\n   btrfs_relocate_chunk+0x3f/0x130\\n   btrfs_balance+0x71b/0xef0\\n   ? kmalloc_trace_noprof+0x13b/0x280\\n   btrfs_ioctl+0x2c2e/0x3030\\n   ? kvfree_call_rcu+0x1e6/0x340\\n   ? list_lru_add_obj+0x66/0x80\\n   ? mntput_no_expire+0x3a/0x220\\n   __x64_sys_ioctl+0x96/0xc0\\n   do_syscall_64+0x54/0x110\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n  RIP: 0033:0x7fcc04514f9b\\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\\n   </TASK>\\n  Modules linked in:\\n  ---[ end trace 0000000000000000 ]---\\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\\n  Kernel p\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:51:48.203Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-49932\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:51:48.203Z\", \"dateReserved\": \"2024-10-21T12:17:06.040Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:54.410Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.