CVE-2024-41067

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: scrub: handle RST lookup error correctly

[BUG]

When running btrfs/060 with forced RST feature, it would crash the

following ASSERT() inside scrub_read_endio():

ASSERT(sector_nr < stripe->nr_sectors);

Before that, we would have tree dump from

btrfs_get_raid_extent_offset(), as we failed to find the RST entry for

the range.

[CAUSE]

Inside scrub_submit_extent_sector_read() every time we allocated a new

bbio we immediately called btrfs_map_block() to make sure there was some

RST range covering the scrub target.

But if btrfs_map_block() fails, we immediately call endio for the bbio,

while the bbio is newly allocated, it's completely empty.

Then inside scrub_read_endio(), we go through the bvecs to find

the sector number (as bi_sector is no longer reliable if the bio is

submitted to lower layers).

And since the bio is empty, such bvecs iteration would not find any

sector matching the sector, and return sector

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References