In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't take dev_replace rwsem on task already holding it
Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep:
BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started
============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Jan 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 11, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-oem-22.04bUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-kvmUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-azure-nvidiaUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.11.0-1011-awsUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-gkeop-6.8Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1027-awsUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oracleUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1027-azureUpgrade linux-image-oem-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-virtualUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-58-lowlatency-64k | Mar 28, 2025 | Jan 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub