In the Linux kernel, the following vulnerability has been resolved:
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct.
Syzbot reported this with the following stack traces:
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52
CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade bpftoolUpgrade python-perfUpgrade kernel-livepatch-5.10.233-223.887Upgrade perf-debuginfoUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.176-118.170 | Mar 14, 2025 | Jan 15, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-libbpfUpgrade kernelUpgrade kernel-livepatch-6.1.124-134.200Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade python3-perf-debuginfo | Mar 27, 2025 | Jan 15, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 10, 2025 | Jan 15, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 15, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-oem-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-5.15.0-135-genericUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-60-genericUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-6.8.0-1029-awsUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-azure-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oracleUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-gke-5.15Upgrade linux-image-awsUpgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-gkeopUpgrade linux-image-azure-cvmUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1029-azureUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-gcpUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeUpgrade linux-image-ibm-classicUpgrade linux-image-aws-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-6.8.0-1028-oemUpgrade linux-image-gkeop-6.8Upgrade linux-image-kvmUpgrade linux-image-intelUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-tegraUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1084-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-fipsUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.11.0-21-genericUpgrade linux-image-genericUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-6.11.0-1013-oracle-64k | Mar 28, 2025 | Jan 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 29, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub