CVE-2024-49932

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't readahead the relocation inode on RST

On relocation we're doing readahead on the relocation inode, but if the

filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to

preallocated extents not being mapped in the RST) from the lookup.

But readahead doesn't handle the error and submits invalid reads to the

device, causing an assertion in the scatter-gather list code:

BTRFS info (device nvme1n1): balance: start -d -m -s

BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0

BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0

------------[ cut here ]------------

kernel BUG at include/linux/scatterlist.h:115!

Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI

CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567

RIP: 0010:__blk_rq_map_sg+0x339/0x4a0

RSP: 0018:ffffc90001a43820 EFLAGS: 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References