{"id":"DEBIAN-CVE-2024-47679","details":"In the Linux kernel, the following vulnerability has been resolved:  vfs: fix race between evice_inodes() and find_inode()&iput()  Hi, all  Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs.  Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super().  cpu0:                              cpu1: iput() // i_count is 1   -\u003espin_lock(inode)   -\u003edec i_count to 0   -\u003eiput_final()                    generic_shutdown_super()     -\u003e__inode_add_lru()               -\u003eevict_inodes()       // cause some reason[2]           -\u003eif (atomic_read(inode-\u003ei_count)) continue;       // return before                  // inode 261 passed the above check       // list_lru_add_obj()             // and then schedule out    -\u003espin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set  btrfs_iget()   // after some function calls   -\u003efind_inode()     // found the above inode 261     -\u003espin_lock(inode)    // check I_FREEING|I_WILL_FREE    // and passed       -\u003e__iget()     -\u003espin_unlock(inode)                // schedule back                                         -\u003espin_lock(inode)                                         // check (I_NEW|I_FREEING|I_WILL_FREE) flags,                                         // passed and set I_FREEING iput()                                  -\u003espin_unlock(inode)   -\u003espin_lock(inode)\t\t\t  -\u003eevict()   // dec i_count to 0   -\u003eiput_final()     -\u003espin_unlock()     -\u003eevict()  Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode-\u003ei_state & I_CLEAR) statement both within clear_inode() and iput().  To fix the bug, recheck the inode-\u003ei_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced.  If there is any misunderstanding, please let me know, thanks.  [1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.","modified":"2026-09-15T09:02:58.519285627Z","published":"2024-10-21T12:15:04.920Z","upstream":["CVE-2024-47679"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-47679"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.115-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47679.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47679.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47679.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}