{"id":"DEBIAN-CVE-2024-57896","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount  During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct.  Syzbot reported this with the following stack traces:    BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089   Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52    CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0   Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024   Workqueue: btrfs-delalloc btrfs_work_helper   Call Trace:    \u003cTASK\u003e    __dump_stack lib/dump_stack.c:94 [inline]    dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120    print_address_description mm/kasan/report.c:378 [inline]    print_report+0x169/0x550 mm/kasan/report.c:489    kasan_report+0x143/0x180 mm/kasan/report.c:602    __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089    lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]    _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162    class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]    try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205    submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615    run_ordered_work fs/btrfs/async-thread.c:288 [inline]    btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324    process_one_work kernel/workqueue.c:3229 [inline]    process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310    worker_thread+0x870/0xd30 kernel/workqueue.c:3391    kthread+0x2f0/0x390 kernel/kthread.c:389    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244    \u003c/TASK\u003e    Allocated by task 2:    kasan_save_stack mm/kasan/common.c:47 [inline]    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68    unpoison_slab_object mm/kasan/common.c:319 [inline]    __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345    kasan_slab_alloc include/linux/kasan.h:250 [inline]    slab_post_alloc_hook mm/slub.c:4104 [inline]    slab_alloc_node mm/slub.c:4153 [inline]    kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205    alloc_task_struct_node kernel/fork.c:180 [inline]    dup_task_struct+0x57/0x8c0 kernel/fork.c:1113    copy_process+0x5d1/0x3d50 kernel/fork.c:2225    kernel_clone+0x223/0x870 kernel/fork.c:2807    kernel_thread+0x1bc/0x240 kernel/fork.c:2869    create_kthread kernel/kthread.c:412 [inline]    kthreadd+0x60d/0x810 kernel/kthread.c:767    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244    Freed by task 24:    kasan_save_stack mm/kasan/common.c:47 [inline]    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68    kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582    poison_slab_object mm/kasan/common.c:247 [inline]    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264    kasan_slab_free include/linux/kasan.h:233 [inline]    slab_free_hook mm/slub.c:2338 [inline]    slab_free mm/slub.c:4598 [inline]    kmem_cache_free+0x195/0x410 mm/slub.c:4700    put_task_struct include/linux/sched/task.h:144 [inline]    delayed_put_task_struct+0x125/0x300 kernel/exit.c:227    rcu_do_batch kernel/rcu/tree.c:2567 [inline]    rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823    handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554    run_ksoftirqd+0xca/0x130 kernel/softirq.c:943    ---truncated---","modified":"2026-09-15T09:03:17.808792122Z","published":"2025-01-15T13:15:14.200Z","upstream":["CVE-2024-57896"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-57896"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.124-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57896.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57896.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57896.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}