In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade reiserfs-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-armUpgrade kernel-default-optionalUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-rtUpgrade dtb-nvidiaUpgrade kernel-symsUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade kernel-kvmsmallUpgrade kernel-rt-extraUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-marvellUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade kernel-azure-extraUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kernel-64kbUpgrade kernel-default-extraUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-default-livepatchUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade kernel-rt-optionalUpgrade kernel-zfcpdumpUpgrade dtb-sprdUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-amazonUpgrade dtb-broadcomUpgrade dtb-apmUpgrade kernel-docsUpgrade kernel-debugUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade kernel-syms-rtUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-obs-qaUpgrade kernel-source-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-64kbUpgrade dtb-socionextUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-vdso | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | No solution existsUpgrade linux-azure-fde-5.15 | Jun 26, 2025 | May 24, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub