CVE-2024-49867

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: wait for fixup workers before stopping cleaner kthread during umount

During unmount, at close_ctree(), we have the following steps in this order:

1) Park the cleaner kthread - this doesn't destroy the kthread, it basically

halts its execution (wake ups against it work but do nothing);

2) We stop the cleaner kthread - this results in freeing the respective

struct task_struct;

3) We call btrfs_stop_all_workers() which waits for any jobs running in all

the work queues and then free the work queues.

Syzbot reported a case where a fixup worker resulted in a crash when doing

a delayed iput on its inode while attempting to wake up the cleaner at

btrfs_add_delayed_iput(), because the task_struct of the cleaner kthread

was already freed. This can happen during unmount because we don't wait

for any fixup workers still running before we call kthread_stop() against

the cleaner kthread, which stops and free al

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References