CVE-2024-42266

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make cow_file_range_inline() honor locked_page on error

The btrfs buffered write path runs through __extent_writepage() which

has some tricky return value handling for writepage_delalloc().

Specifically, when that returns 1, we exit, but for other return values

we continue and end up calling btrfs_folio_end_all_writers(). If the

folio has been unlocked (note that we check the PageLocked bit at the

start of __extent_writepage()), this results in an assert panic like

this one from syzbot:

BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure

BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction.

BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure

assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871

------------[ cut here ]------------

kernel BUG at fs/btrfs/subpage.c:871!

Oops: invalid opcode: 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References