Executive brief
A flaw in the Linux kernel's btrfs file system can corrupt the in-memory extent map data structure during file operations involving extent range dropping with pinned extents. This corruption can lead to invalid or overlapping extent entries, potentially causing data corruption, file system errors, or system crashes during normal relocation operations.
Technical details
The vulnerability is an arithmetic error in the btrfs_drop_extent_map_range() function when handling pinned extents during extent map splitting. When a pinned extent is skipped, the len variable is incorrectly updated (should be 20K but becomes 36K in the example), causing the subsequent split calculation to compute an invalid split->start position and negative split->len values due to integer overflow. This results in invalid extent map entries being inserted into the tree with potentially overlapping ranges. The flaw is triggered during file relocation operations with skip_pinned enabled, which occurs during btrfs relocation and auto-relocation. The fix replaces the len variable tracking with direct use of the end parameter to avoid the calculation error.
Affected products
- Linux Linux kernel versions prior to fix
Timeline
- 2025-12-24: disclosed