In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-64kb-livepatch-develUpgrade dtb-amdUpgrade kernel-rt-vdsoUpgrade kernel-syms-rtUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-source-rtUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade dtb-marvellUpgrade kernel-rt_debug-develUpgrade kernel-docsUpgrade kernel-obs-qaUpgrade dtb-renesasUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade dtb-amlogicUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade dlm-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-azureUpgrade dtb-amazonUpgrade dtb-apmUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-rt-optionalUpgrade dtb-freescaleUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-rtUpgrade dtb-broadcomUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dtb-sprdUpgrade kernel-debugUpgrade kernel-syms-azureUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-rt-develUpgrade kernel-develUpgrade dtb-mediatekUpgrade kernel-azure-develUpgrade dlm-kmp-64kbUpgrade dtb-lgUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade dtb-caviumUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-source-azureUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade dtb-exynosUpgrade kernel-symsUpgrade kernel-obs-buildUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade dtb-altera | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-azure-fde-5.15No solution exists | Jun 26, 2025 | May 24, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub