In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix double free of anonymous device after snapshot creation failure
When creating a snapshot we may do a double free of an anonymous device in case there's an error committing the transaction. The second free may result in freeing an anonymous device number that was allocated by some other subsystem in the kernel or another btrfs filesystem.
The steps that lead to this:
1) At ioctl.c:create_snapshot() we allocate an anonymous device number and assign it to pending_snapshot->anon_dev;
2) Then we call btrfs_commit_transaction() and end up at transaction.c:create_pending_snapshot();
3) There we call btrfs_get_new_fs_root() and pass it the anonymous device number stored in pending_snapshot->anon_dev;
4) btrfs_get_new_fs_root() frees that anonymous device number because btrfs_lookup_fs_root() returned a root - someone else did a lookup of the new root already, which could some task doing backref walking;
5) After that some error happens in the transaction commit path, and at ioctl.c:create_snapshot() we jump to the 'fail' label, and after that we free again the same anonymous device number, which in the meanwhile may have been reallocated somewhere else, because pending_snapshot->anon_dev still has the same value as in step 1.
Recently syzbot ran into this and reported the following trace:
------------[ cut here ]------------ ida_free called for id=51 which is not allocated. WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525 Modules linked in: CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525 Code: 10 42 80 3c 28 (...) RSP: 0018:ffffc90015a67300 EFLAGS: 00010246 RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000 RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4 R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246 R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246 FS: 00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0 Call Trace: <TASK> btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346 create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837 create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931 btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404 create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848 btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998 btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044 __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306 btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393 btrfs_ioctl+0xa74/0xd40 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7fca3e67dda9 Code: 28 00 00 00 (...) RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9 RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658 </TASK>
Where we get an explicit message where we attempt to free an anonymous device number that is not currently allocated. It happens in a different code path from the example below, at btrfs_get_root_ref(), so this change may not fix the case triggered by sy ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.82-99.168Upgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-develUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-libbpf-staticUpgrade perf | Feb 17, 2025 | Apr 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade kernel-symsUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade dtb-hisiliconUpgrade dtb-armUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-source-vanillaUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-develUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-amdUpgrade kernel-default-vdsoUpgrade dtb-amazonUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade kernel-debugUpgrade dtb-sprdUpgrade kernel-azureUpgrade kernel-devel-rtUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade dtb-caviumUpgrade kernel-default-baseUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade kernel-source-azureUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade dtb-apmUpgrade kernel-docs-htmlUpgrade dtb-exynosUpgrade reiserfs-kmp-rtUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade dtb-marvellUpgrade kernel-obs-qaUpgrade kernel-debug-vdsoUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade kernel-docsUpgrade dtb-socionextUpgrade kernel-kvmsmallUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade dtb-freescaleUpgrade dtb-rockchipUpgrade dlm-kmp-azureUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-source | May 15, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-azureUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-raspiUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-azure-lts-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-oem-20.04cUpgrade linux-image-kvmUpgrade linux-image-starfiveUpgrade linux-image-oem-22.04dUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-112-genericUpgrade linux-image-generic-64kUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-intelUpgrade linux-image-oem-22.04aUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.5.0-1023-awsUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-oem-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-gke-5.15Upgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1024-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-virtualUpgrade linux-image-oem-20.04bUpgrade linux-image-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-generic-hwe-22.04 | Jul 1, 2024 | Apr 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub