CVE-2024-46734 in Linux
Summary
by MITRE • 09/18/2024
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either:
1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled;
2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed.
The race happens like this:
1) A user space program opens a file descriptor with O_DIRECT;
2) The program spawns 2 threads using libpthread for example;
3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor.
4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs;
5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true;
6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock;
7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock;
8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it.
The stack trace produced is the following:
assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------
kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs]
Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]
? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]
? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]
? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]
btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]
? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mod ---truncated---
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/05/2026
The vulnerability CVE-2024-46734 resides within the Linux kernel's btrfs file system implementation and represents a race condition that arises when multiple threads operate concurrently on the same file descriptor using direct I/O writes and fsync operations. This flaw manifests when one thread performs direct I/O writes while another simultaneously executes fsync on the same file descriptor, leading to inconsistent locking states and potential memory access violations. The core issue stems from improper synchronization between these concurrent operations, specifically around how the file's private data structure is managed during direct I/O and fsync execution paths. The race condition occurs during the transition from direct I/O write completion to fsync processing, where the file descriptor's private data structure points to stack-allocated memory that may be accessed after stack deallocation, resulting in invalid memory access or assertion failures.
The technical flaw involves the btrfs file system's handling of file private data structures during direct I/O operations. When a thread performs a direct I/O write, it allocates a private structure on the stack and assigns it to the file descriptor. This structure contains a flag `fsync_skip_inode_lock` set to true, indicating that the subsequent fsync operation should skip acquiring the inode's VFS lock. However, when the direct I/O thread completes its operation, it resets the file's private pointer to NULL, having no prior private data, while also releasing the inode's VFS lock. The fsync thread, which was not required to acquire the lock due to the flag, then attempts to access the same memory location that has already been invalidated, causing either an assertion failure or a kernel panic due to invalid memory access. This behavior violates fundamental locking principles and memory management practices within kernel space operations.
The operational impact of this vulnerability is significant for systems utilizing btrfs file systems with concurrent direct I/O and fsync operations. Systems that rely on multi-threaded applications performing direct I/O writes alongside fsync calls are at risk of experiencing kernel panics, system crashes, or data corruption. The vulnerability specifically affects environments where applications spawn multiple threads using the same file descriptor for direct I/O operations while also invoking fsync operations concurrently. The risk is particularly high in high-performance computing environments, database systems, or any application that demands strict data consistency guarantees through fsync operations while simultaneously performing direct I/O for performance optimization. The condition can be triggered by relatively simple multi-threaded applications, making it a widespread concern across various deployment scenarios.
Mitigation strategies for this vulnerability involve applying the kernel patch that resolves the race condition by ensuring proper locking mechanisms are maintained throughout the direct I/O and fsync execution paths. The fix typically requires modifications to how the file private data structure is managed during concurrent access, ensuring that the fsync operation always acquires the necessary inode locks regardless of the `fsync_skip_inode_lock` flag. Administrators should prioritize updating their kernel versions to include the patched btrfs implementation, particularly in production environments where concurrent direct I/O and fsync operations are common. Additional defensive measures include monitoring for kernel panic reports and implementing proper application-level synchronization to reduce the likelihood of triggering this race condition. From an ATT&CK perspective, this vulnerability aligns with techniques involving kernel exploitation and privilege escalation through system-level flaws, while CWE classification places it under CWE-362, Concurrency Issues, specifically addressing race conditions in concurrent programming scenarios.