CVE-2024-46733

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix qgroup reserve leaks in cow_file_range

In the buffered write path, the dirty page owns the qgroup reserve until

it creates an ordered_extent.

Therefore, any errors that occur before the ordered_extent is created

must free that reservation, or else the space is leaked. The fstest

generic/475 exercises various IO error paths, and is able to trigger

errors in cow_file_range where we fail to get to allocating the ordered

extent. Note that because we *do* clear delalloc, we are likely to

remove the inode from the delalloc list, so the inodes/pages to not have

invalidate/launder called on them in the commit abort path.

This results in failures at the unmount stage of the test that look like:

BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure

BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure

BTRFS warning (device dm-8 state EA):

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References