CVE-2024-42266 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-42266 Interim 1 11 2025-10-05T00:03:13Z current 2024-08-17T23:10:02Z 2025-10-05T00:03:13Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-42266 In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __extent_writepage fs/btrfs/extent_io.c:1597 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline] btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373 do_writepages+0x359/0x870 mm/page-writeback.c:2656 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] __filemap_fdatawrite mm/filemap.c:436 [inline] filemap_flush+0xdf/0x130 mm/filemap.c:463 btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:222 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:877 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f. I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design. I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack: folio_unlock+5 __process_pages_contig+475 cow_file_range_inline.constprop.0+230 cow_file_range+803 btrfs_run_delalloc_range+566 writepage_delalloc+332 __extent_writepage # inlined in my stacktrace, but I added it here extent_write_cache_pages+622 Looking at the bisected-to pa ---truncated--- The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Real Time 12 SP5 SUSE Real Time Module 15 SP5 SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 12 SP3-LTSS SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Micro 6.0 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.5 openSUSE Leap 15.6 cluster-md-kmp-default dlm-kmp-default gfs2-kmp-default kernel-default kernel-default-base kernel-default-devel kernel-default-extra kernel-default-livepatch kernel-default-livepatch-devel kernel-default-man kernel-default-optional kernel-default-vdso kernel-devel kernel-devel-azure kernel-devel-rt kernel-macros kernel-rt kernel-source kernel-source-azure kernel-source-rt kernel-source-vanilla kselftests-kmp-default ocfs2-kmp-default reiserfs-kmp-default kernel-default as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-source as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-default as a component of SUSE Linux Enterprise Micro 5.0 kernel-default as a component of SUSE Linux Enterprise Micro 5.1 kernel-rt as a component of SUSE Linux Enterprise Micro 5.1 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.1 kernel-default as a component of SUSE Linux Enterprise Micro 5.2 kernel-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-default as a component of SUSE Linux Enterprise Micro 5.3 kernel-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-default as a component of SUSE Linux Enterprise Micro 5.4 kernel-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-devel-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-default as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-default-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-macros as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-source as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-default as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-default-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-macros as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-source as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-default as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 kernel-source as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 kernel-default as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-source as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP6 kernel-devel-rt as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-source-rt as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-default as a component of SUSE Linux Enterprise Server 11 SP4 LTSS kernel-source as a component of SUSE Linux Enterprise Server 11 SP4 LTSS kernel-default as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-base as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-devel as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-source as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP5 kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP5 kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP5 kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP5 kernel-devel as a component of SUSE Linux Enterprise Server 12 SP5 kernel-macros as a component of SUSE Linux Enterprise Server 12 SP5 kernel-source as a component of SUSE Linux Enterprise Server 12 SP5 kernel-devel-azure as a component of SUSE Linux Enterprise Server 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server 12 SP5 kernel-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 15 SP1-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 15-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-source as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-default as a component of SUSE Linux Enterprise Server Teradata 12 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise Server Teradata 12 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-default as a component of SUSE Linux Micro 6.0 kernel-devel as a component of SUSE Linux Micro 6.0 kernel-macros as a component of SUSE Linux Micro 6.0 kernel-source as a component of SUSE Linux Micro 6.0 kernel-devel-rt as a component of SUSE Linux Micro 6.0 kernel-source-rt as a component of SUSE Linux Micro 6.0 kernel-default as a component of SUSE Manager Proxy 4.3 kernel-default-devel as a component of SUSE Manager Proxy 4.3 kernel-devel as a component of SUSE Manager Proxy 4.3 kernel-macros as a component of SUSE Manager Proxy 4.3 kernel-source as a component of SUSE Manager Proxy 4.3 kernel-default as a component of SUSE Manager Retail Branch Server 4.3 kernel-default-devel as a component of SUSE Manager Retail Branch Server 4.3 kernel-devel as a component of SUSE Manager Retail Branch Server 4.3 kernel-macros as a component of SUSE Manager Retail Branch Server 4.3 kernel-source as a component of SUSE Manager Retail Branch Server 4.3 kernel-default as a component of SUSE Manager Server 4.3 kernel-default-devel as a component of SUSE Manager Server 4.3 kernel-devel as a component of SUSE Manager Server 4.3 kernel-macros as a component of SUSE Manager Server 4.3 kernel-source as a component of SUSE Manager Server 4.3 kernel-devel-rt as a component of SUSE Real Time Module 15 SP5 kernel-source-rt as a component of SUSE Real Time Module 15 SP5 cluster-md-kmp-default as a component of openSUSE Leap 15.5 dlm-kmp-default as a component of openSUSE Leap 15.5 gfs2-kmp-default as a component of openSUSE Leap 15.5 kernel-default as a component of openSUSE Leap 15.5 kernel-default-devel as a component of openSUSE Leap 15.5 kernel-default-extra as a component of openSUSE Leap 15.5 kernel-default-livepatch as a component of openSUSE Leap 15.5 kernel-default-livepatch-devel as a component of openSUSE Leap 15.5 kernel-default-optional as a component of openSUSE Leap 15.5 kernel-default-vdso as a component of openSUSE Leap 15.5 kselftests-kmp-default as a component of openSUSE Leap 15.5 ocfs2-kmp-default as a component of openSUSE Leap 15.5 reiserfs-kmp-default as a component of openSUSE Leap 15.5 kernel-devel as a component of openSUSE Leap 15.5 kernel-macros as a component of openSUSE Leap 15.5 kernel-source as a component of openSUSE Leap 15.5 kernel-source-vanilla as a component of openSUSE Leap 15.5 kernel-devel-azure as a component of openSUSE Leap 15.5 kernel-source-azure as a component of openSUSE Leap 15.5 kernel-devel-rt as a component of openSUSE Leap 15.5 kernel-source-rt as a component of openSUSE Leap 15.5 cluster-md-kmp-default as a component of openSUSE Leap 15.6 dlm-kmp-default as a component of openSUSE Leap 15.6 gfs2-kmp-default as a component of openSUSE Leap 15.6 kernel-default as a component of openSUSE Leap 15.6 kernel-default-devel as a component of openSUSE Leap 15.6 kernel-default-extra as a component of openSUSE Leap 15.6 kernel-default-livepatch as a component of openSUSE Leap 15.6 kernel-default-livepatch-devel as a component of openSUSE Leap 15.6 kernel-default-optional as a component of openSUSE Leap 15.6 kernel-default-vdso as a component of openSUSE Leap 15.6 kselftests-kmp-default as a component of openSUSE Leap 15.6 ocfs2-kmp-default as a component of openSUSE Leap 15.6 reiserfs-kmp-default as a component of openSUSE Leap 15.6 kernel-devel as a component of openSUSE Leap 15.6 kernel-macros as a component of openSUSE Leap 15.6 kernel-source as a component of openSUSE Leap 15.6 kernel-source-vanilla as a component of openSUSE Leap 15.6 kernel-devel-azure as a component of openSUSE Leap 15.6 kernel-source-azure as a component of openSUSE Leap 15.6 kernel-devel-rt as a component of openSUSE Leap 15.6 kernel-source-rt as a component of openSUSE Leap 15.6 In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __extent_writepage fs/btrfs/extent_io.c:1597 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline] btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373 do_writepages+0x359/0x870 mm/page-writeback.c:2656 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] __filemap_fdatawrite mm/filemap.c:436 [inline] filemap_flush+0xdf/0x130 mm/filemap.c:463 btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:222 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:877 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f. I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design. I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack: folio_unlock+5 __process_pages_contig+475 cow_file_range_inline.constprop.0+230 cow_file_range+803 btrfs_run_delalloc_range+566 writepage_delalloc+332 __extent_writepage # inlined in my stacktrace, but I added it here extent_write_cache_pages+622 Looking at the bisected-to pa ---truncated--- CVE-2024-42266 SUSE Linux Enterprise High Performance Computing 12 SP5:kernel-default SUSE Linux Enterprise High Performance Computing 12 SP5:kernel-source SUSE Linux Enterprise High Performance Computing 12 SP5:kernel-source-azure SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:reiserfs-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:reiserfs-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Micro 5.0:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-rt SUSE Linux Enterprise Micro 5.1:kernel-source-rt SUSE Linux Enterprise Micro 5.2:kernel-default SUSE Linux Enterprise Micro 5.2:kernel-rt SUSE Linux Enterprise Micro 5.2:kernel-source-rt SUSE Linux Enterprise Micro 5.3:kernel-default SUSE Linux Enterprise Micro 5.3:kernel-rt SUSE Linux Enterprise Micro 5.3:kernel-source-rt SUSE Linux Enterprise Micro 5.4:kernel-default SUSE Linux Enterprise Micro 5.4:kernel-rt SUSE Linux Enterprise Micro 5.4:kernel-source-rt SUSE Linux Enterprise Micro 5.5:kernel-devel-rt SUSE Linux Enterprise Micro 5.5:kernel-source-rt SUSE Linux Enterprise Module for Basesystem 15 SP5:kernel-default SUSE Linux Enterprise Module for Basesystem 15 SP5:kernel-default-devel SUSE Linux Enterprise Module for Basesystem 15 SP5:kernel-devel SUSE Linux Enterprise Module for Basesystem 15 SP5:kernel-macros SUSE Linux Enterprise Module for Basesystem 15 SP5:kernel-source SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-default SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-default-devel SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-devel SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-macros SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-source SUSE Linux Enterprise Module for Development Tools 15 SP5:kernel-default SUSE Linux Enterprise Module for Development Tools 15 SP5:kernel-source SUSE Linux Enterprise Module for Development Tools 15 SP6:kernel-default SUSE Linux Enterprise Module for Development Tools 15 SP6:kernel-source SUSE Linux Enterprise Module for Public Cloud 15 SP5:kernel-devel-azure SUSE Linux Enterprise Module for Public Cloud 15 SP5:kernel-source-azure SUSE Linux Enterprise Module for Public Cloud 15 SP6:kernel-devel-azure SUSE Linux Enterprise Module for Public Cloud 15 SP6:kernel-source-azure SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-base SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-devel SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-source SUSE Linux Enterprise Server 11 SP4 LTSS:kernel-default SUSE Linux Enterprise Server 11 SP4 LTSS:kernel-source SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP5:kernel-default SUSE Linux Enterprise Server 12 SP5:kernel-default-base SUSE Linux Enterprise Server 12 SP5:kernel-default-devel SUSE Linux Enterprise Server 12 SP5:kernel-default-man SUSE Linux Enterprise Server 12 SP5:kernel-devel SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure SUSE Linux Enterprise Server 12 SP5:kernel-macros SUSE Linux Enterprise Server 12 SP5:kernel-source SUSE Linux Enterprise Server 12 SP5:kernel-source-azure SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-base SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-man SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP1-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP2-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP3-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP4-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15-LTSS:kernel-default SUSE Linux Enterprise Server 15-LTSS:kernel-default-base SUSE Linux Enterprise Server 15-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15-LTSS:kernel-default-man SUSE Linux Enterprise Server 15-LTSS:kernel-devel SUSE Linux Enterprise Server 15-LTSS:kernel-macros SUSE Linux Enterprise Server 15-LTSS:kernel-source SUSE Linux Enterprise Server 15-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:kernel-default SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:kernel-source SUSE Linux Enterprise Server Teradata 12 SP3:kernel-default SUSE Linux Enterprise Server Teradata 12 SP3:kernel-source SUSE Linux Enterprise Server Teradata 15 SP4:kernel-default SUSE Linux Enterprise Server Teradata 15 SP4:kernel-source SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-default SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure SUSE Linux Enterprise Server for SAP Applications 15 SP2:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP2:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP2:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP2:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP2:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP2:reiserfs-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP3:reiserfs-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP4:reiserfs-kmp-default SUSE Linux Micro 6.0:kernel-default SUSE Linux Micro 6.0:kernel-devel SUSE Linux Micro 6.0:kernel-devel-rt SUSE Linux Micro 6.0:kernel-macros SUSE Linux Micro 6.0:kernel-source SUSE Linux Micro 6.0:kernel-source-rt SUSE Manager Proxy 4.3:kernel-default SUSE Manager Proxy 4.3:kernel-default-devel SUSE Manager Proxy 4.3:kernel-devel SUSE Manager Proxy 4.3:kernel-macros SUSE Manager Proxy 4.3:kernel-source SUSE Manager Retail Branch Server 4.3:kernel-default SUSE Manager Retail Branch Server 4.3:kernel-default-devel SUSE Manager Retail Branch Server 4.3:kernel-devel SUSE Manager Retail Branch Server 4.3:kernel-macros SUSE Manager Retail Branch Server 4.3:kernel-source SUSE Manager Server 4.3:kernel-default SUSE Manager Server 4.3:kernel-default-devel SUSE Manager Server 4.3:kernel-devel SUSE Manager Server 4.3:kernel-macros SUSE Manager Server 4.3:kernel-source SUSE Real Time Module 15 SP5:kernel-devel-rt SUSE Real Time Module 15 SP5:kernel-source-rt openSUSE Leap 15.5:cluster-md-kmp-default openSUSE Leap 15.5:dlm-kmp-default openSUSE Leap 15.5:gfs2-kmp-default openSUSE Leap 15.5:kernel-default openSUSE Leap 15.5:kernel-default-devel openSUSE Leap 15.5:kernel-default-extra openSUSE Leap 15.5:kernel-default-livepatch openSUSE Leap 15.5:kernel-default-livepatch-devel openSUSE Leap 15.5:kernel-default-optional openSUSE Leap 15.5:kernel-default-vdso openSUSE Leap 15.5:kernel-devel openSUSE Leap 15.5:kernel-devel-azure openSUSE Leap 15.5:kernel-devel-rt openSUSE Leap 15.5:kernel-macros openSUSE Leap 15.5:kernel-source openSUSE Leap 15.5:kernel-source-azure openSUSE Leap 15.5:kernel-source-rt openSUSE Leap 15.5:kernel-source-vanilla openSUSE Leap 15.5:kselftests-kmp-default openSUSE Leap 15.5:ocfs2-kmp-default openSUSE Leap 15.5:reiserfs-kmp-default openSUSE Leap 15.6:cluster-md-kmp-default openSUSE Leap 15.6:dlm-kmp-default openSUSE Leap 15.6:gfs2-kmp-default openSUSE Leap 15.6:kernel-default openSUSE Leap 15.6:kernel-default-devel openSUSE Leap 15.6:kernel-default-extra openSUSE Leap 15.6:kernel-default-livepatch openSUSE Leap 15.6:kernel-default-livepatch-devel openSUSE Leap 15.6:kernel-default-optional openSUSE Leap 15.6:kernel-default-vdso openSUSE Leap 15.6:kernel-devel openSUSE Leap 15.6:kernel-devel-azure openSUSE Leap 15.6:kernel-devel-rt openSUSE Leap 15.6:kernel-macros openSUSE Leap 15.6:kernel-source openSUSE Leap 15.6:kernel-source-azure openSUSE Leap 15.6:kernel-source-rt openSUSE Leap 15.6:kernel-source-vanilla openSUSE Leap 15.6:kselftests-kmp-default openSUSE Leap 15.6:ocfs2-kmp-default openSUSE Leap 15.6:reiserfs-kmp-default moderate 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L