CVE-2024-26726

一、漏洞信息
 漏洞编号：[CVE-2024-26726](https://nvd.nist.gov/vuln/detail/CVE-2024-26726)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: don t drop extent_map for free space inode on write errorWhile running the CI for an unrelated change I hit the following panicwith generic/648 on btrfs_holes_spacecache.assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385------------[ cut here ]------------kernel BUG at fs/btrfs/extent_io.c:1385!invalid opcode: 0000 [#1] PREEMPT SMP NOPTICPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76This happens because we fail to write out the free space cache in oneinstance, come back around and attempt to write it again.  However onthe second pass through we go to call btrfs_get_extent() on the inode toget the extent mapping.  Because this is a new block group, and with thefree space inode we always search the commit root to avoid deadlockingwith the tree, we find nothing and return a EXTENT_MAP_HOLE for therequested range.This happens because the first time we try to write the space cache outwe hit an error, and on an error we drop the extent mapping.  This isnormal for normal files, but the free space cache inode is special.  Wealways expect the extent map to be correct.  Thus the second timethrough we end up with a bogus extent map.Since we re deprecating this feature, the most straightforward way tofix this is to simply skip dropping the extent map range for this failedrange.I shortened the test by using error injection to stress the area to makeit easier to reproduce.  With this patch in place we no longer panicwith my error injection test.
 漏洞公开时间：2024-04-03 23:15:54
 漏洞创建时间：2024-04-03 23:39:56
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26726
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26726 | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26726.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26726 | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2273128 | https://bugzilla.suse.com/show_bug.cgi?id=1222532 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024040346-CVE-2024-26726-fed0@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2273128 |
| ubuntu | https://git.kernel.org/linus/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade (6.8-rc5) | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://git.kernel.org/stable/c/02f2b95b00bf57d20320ee168b30fb7f3db8e555 | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://git.kernel.org/stable/c/7bddf18f474f166c19f91b2baf67bf7c5eda03f7 | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://git.kernel.org/stable/c/a4b7741c8302e28073bfc6dd1c2e73598e5e535e | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://git.kernel.org/stable/c/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26726 | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26726 | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26726 | https://ubuntu.com/security/CVE-2024-26726 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26726 | https://ubuntu.com/security/CVE-2024-26726 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26726 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26726 | https://ubuntu.com/security/CVE-2024-26726 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/5571e41ec6e56e35f34ae9f5b3a335ef510e0ade | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
            In the Linux kernel, the following vulnerability has been resolved:btrfs: don t drop extent_map for free space inode on write errorWhile running the CI for an unrelated change I hit the following panicwith generic/648 on btrfs_holes_spacecache.assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385------------[ cut here ]------------kernel BUG at fs/btrfs/extent_io.c:1385!invalid opcode: 0000 [#1] PREEMPT SMP NOPTICPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76This happens because we fail to write out the free space cache in oneinstance, come back around and attempt to write it again.  However onthe second pass through we go to call btrfs_get_extent() on the inode toget the extent mapping.  Because this is a new block group, and with thefree space inode we always search the commit root to avoid deadlockingwith the tree, we find nothing and return a EXTENT_MAP_HOLE for therequested range.This happens because the first time we try to write the space cache outwe hit an error, and on an error we drop the extent mapping.  This isnormal for normal files, but the free space cache inode is special.  Wealways expect the extent map to be correct.  Thus the second timethrough we end up with a bogus extent map.Since we re deprecating this feature, the most straightforward way tofix this is to simply skip dropping the extent map range for this failedrange.I shortened the test by using error injection to stress the area to makeit easier to reproduce.  With this patch in place we no longer panicwith my error injection test.     
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS(5.10.0):受影响
4.openEuler-22.03-LTS-SP1(5.10.0):受影响
5.openEuler-22.03-LTS-SP2(5.10.0):受影响
6.openEuler-22.03-LTS-SP3(5.10.0):受影响
7.master(6.1.0):不受影响
8.openEuler-22.03-LTS-Next(5.10.0):不受影响
9.openEuler-24.03-LTS:不受影响
10.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1649

src-openEuler/kernel
Closed

Content Risk Flag

Comments (19)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26726

Comments (19)

Search

src-openEuler/kernel
Closed