CVE-2024-57896

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount

During the unmount path, at close_ctree(), we first stop the cleaner

kthread, using kthread_stop() which frees the associated task_struct, and

then stop and destroy all the work queues. However after we stopped the

cleaner we may still have a worker from the delalloc_workers queue running

inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(),

which in turn tries to wake up the cleaner kthread - which was already

destroyed before, resulting in a use-after-free on the task_struct.

Syzbot reported this with the following stack traces:

BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089

Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52

CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0

Hardware name: Google Goo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References