Linux kernel (btrfs) vulnerabilities

In the Linux kernel, a bug in btrfs occurs when replacing the value of an extended attribute (xattr) if multiple xattrs are packed into the same btrfs_dir_item. The new btrfs_dir_item is not fully initialized, leading to tree corruption detected by the tree checker during extent buffer writeback.

In the Linux kernel, a bug in the btrfs subsystem forces unnecessary reloc root creation during snapshot creation when qgroups (quota) are enabled. This triggers a kernel warning in lookup_inline_extent_backref and flips the filesystem to read-only mode. The issue is reproducible during balance/relocate operations on a btrfs filesystem with quota enabled.

In the Linux kernel's btrfs subsystem, a use-after-free vulnerability exists related to relocation operations. When insert_dirty_subvol() fails, a root's reloc_root field remains pointing to a freed reloc root instead of being set to NULL, leading to a use-after-free or double free during filesystem unmount.

In the Linux kernel, a race condition exists in the btrfs subsystem between the thread finishing an extent buffer read and the thread unmounting the filesystem. The EXTENT_BUFFER_READING flag is not cleared within the same critical section as the reference count decrement, leading to false warnings in invalidate_and_check_btree_folios(). The fix introduces a helper free_extent_buffer_clear_reading() and synchronization on refs_lock.

A deadlock exists in the Linux kernel's btrfs filesystem during file defragmentation when autodefrag is enabled. Defrag reserves delalloc space while holding dirty and locked folios plus the extent range lock, causing kernel tasks (btrfs-cleaner, writeback, metadata reclaim) to block each other.

A flaw was found in the Linux kernel btrfs subsystem where write-protection of folios during data writeback was lost. A code change replaced folio_clear_dirty_for_io() with a plain folio_test_dirty() check, allowing a process with an mmap-ed file to modify sectors while writeback is in progress. This can cause checksum corruption, lost writes, and data corruption for compressed or inline extents.

A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().