In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix crash on racing fsync and size-extending write into prealloc

We have been seeing crashes on duplicate keys in
btrfs_set_item_key_safe():

BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)
——————[ cut here ]——————
kernel BUG at fs/btrfs/ctree.c:2620!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]

With the following stack trace:

#0 btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)
#1 btrfs_drop_extents (fs/btrfs/file.c:411:4)
#2 log_one_extent (fs/btrfs/tree-log.c:4732:9)
#3 btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)
#4 btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)
#5 btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)
#6 btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)
#7 btrfs_sync_file (fs/btrfs/file.c:1933:8)
#8 vfs_fsync_range (fs/sync.c:188:9)
#9 vfs_fsync (fs/sync.c:202:9)
#10 do_fsync (fs/sync.c:212:9)
#11 __do_sys_fdatasync (fs/sync.c:225:9)
#12 __se_sys_fdatasync (fs/sync.c:223:1)
#13 __x64_sys_fdatasync (fs/sync.c:223:1)
#14 do_syscall_x64 (arch/x86/entry/common.c:52:14)
#15 do_syscall_64 (arch/x86/entry/common.c:83:7)
#16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)

So we’re logging a changed extent from fsync, which is splitting an
extent in the log tree. But this split part already exists in the tree,
triggering the BUG().

This is the state of the log tree at the time of the crash, dumped with
drgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)
to get more details than btrfs_print_leaf() gives us:

print_extent_buffer(prog.crashed_thread().stack_trace()[0][“eb”])
leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610
leaf 33439744 flags 0x100000000000000
fs uuid e5bd3946-400c-4223-8923-190ef1f18677
chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da

      item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160
              generation 7 transid 9 size 8192 nbytes 8473563889606862198
              block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0
              sequence 204 flags 0x10(PREALLOC)
              atime 1716417703.220000000 (2024-05-22 15:41:43)
              ctime 1716417704.983333333 (2024-05-22 15:41:44)
              mtime 1716417704.983333333 (2024-05-22 15:41:44)
              otime 17592186044416.000000000 (559444-03-08 01:40:16)
      item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13
              index 195 namelen 3 name: 193
      item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37
              location key (0 UNKNOWN.0 0) type XATTR
              transid 7 data_len 1 name_len 6
              name: user.a
              data a
      item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53
              generation 9 type 1 (regular)
              extent data disk byte 303144960 nr 12288
              extent data offset 0 nr 4096 ram 12288
              extent compression 0 (none)
      item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53
              generation 9 type 2 (prealloc)
              prealloc data disk byte 303144960 nr 12288
              prealloc data offset 4096 nr 8192
      item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53
              generation 9 type 2 (prealloc)
              prealloc data disk byte 303144960 nr 12288
              prealloc data offset 8192 nr 4096

…

So the real problem happened earlier: notice that items 4 (4k-12k) and 5
(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and
item 5 starts at i_size.

Here is the state of
—-truncated—-