ACK: [SRU][J][PATCH 0/1] CVE-2025-39779

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 9/19/26 01:44, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-39779
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> btrfs: subpage: keep TOWRITE tag until folio is cleaned
>
> btrfs_subpage_set_writeback() calls folio_start_writeback() the first time a
> folio is written back, and it also clears the PAGECACHE_TAG_TOWRITE tag even if
> there are still dirty blocks in the folio. This can break ordering guarantees,
> such as those required by btrfs_wait_ordered_extents().
>
> That ordering breakage leads to a real failure. For example, running
> generic/464 on a zoned setup will hit the following ASSERT. This happens
> because the broken ordering fails to flush existing dirty pages before the file
> size is truncated.
>
> assertion failed: !list_empty(&ordered->list) :: 0, in fs/btrfs/zoned.c:1899
> ------------[ cut here ]------------ kernel BUG at fs/btrfs/zoned.c:1899! Oops:
> invalid opcode: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 1906169 Comm:
> kworker/u130:2 Kdump: loaded Not tainted 6.16.0-rc6-BTRFS-ZNS+ #554
> PREEMPT(voluntary) Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.0
> 02/22/2021 Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] RIP:
> 0010:btrfs_finish_ordered_zoned.cold+0x50/0x52 [btrfs] RSP:
> 0018:ffffc9002efdbd60 EFLAGS: 00010246 RAX: 000000000000004c RBX:
> ffff88811923c4e0 RCX: 0000000000000000 RDX: 0000000000000000 RSI:
> ffffffff827e38b1 RDI: 00000000ffffffff RBP: ffff88810005d000 R08:
> 00000000ffffdfff R09: ffffffff831051c8 R10: ffffffff83055220 R11:
> 0000000000000000 R12: ffff8881c2458c00 R13: ffff88811923c540 R14:
> ffff88811923c5e8 R15: ffff8881c1bd9680 FS: 0000000000000000(0000)
> GS:ffff88a04acd0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000
> CR0: 0000000080050033 CR2: 00007f907c7a918c CR3: 0000000004024000 CR4:
> 0000000000350ef0 Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f
> btrfs_finish_ordered_io+0x4a/0x60 [btrfs] btrfs_work_helper+0xf9/0x490 [btrfs]
> process_one_work+0x204/0x590 ? srso_return_thunk+0x5/0x5f
> worker_thread+0x1d6/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x118/0x230 ?
> __pfx_kthread+0x10/0x10 ret_from_fork+0x205/0x260 ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30 </TASK>
>
> Consider process A calling writepages() with WB_SYNC_NONE. In zoned mode or for
> compressed writes, it locks several folios for delalloc and starts writing them
> out. Let's call the last locked folio folio X. Suppose the write range only
> partially covers folio X, leaving some pages dirty. Process A calls
> btrfs_subpage_set_writeback() when building a bio. This function call clears
> the TOWRITE tag of folio X, whose size = 8K and the block size = 4K. It is
> following state.
>
> 0 4K 8K |/////|/////| (flag: DIRTY, tag: DIRTY) <-----> Process A will write
> this range.
>
> Now suppose process B concurrently calls writepages() with WB_SYNC_ALL. It
> calls tag_pages_for_writeback() to tag dirty folios with PAGECACHE_TAG_TOWRITE.
> Since folio X is still dirty, it gets tagged. Then, B collects tagged folios
> using filemap_get_folios_tag() and must wait for folio X to be written before
> returning from writepages().
>
> 0 4K 8K |/////|/////| (flag: DIRTY, tag: DIRTY|TOWRITE)
>
> However, between tagging and collecting, process A may call
> btrfs_subpage_set_writeback() and clear folio X's TOWRITE tag. 0 4K 8K |
> |/////| (flag: DIRTY|WRITEBACK, tag: DIRTY)
>
> As a result, process B won't see folio X in its batch, and returns without
> waiting for it. This breaks the WB_SYNC_ALL ordering requirement.
>
> Fix this by using btrfs_subpage_set_writeback_keepwrite(), which retains the
> TOWRITE tag. We now manually clear the tag only after the folio becomes clean,
> via the xas operation.
>
> [ Fix ]
>
> jammy/linux: backported from b1511360c8ac
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect btrfs on systems where the page size is
> larger than the filesystem block size (subpage mode), such as 64K-page arm64
> or ppc64le hosts running a 4K-block btrfs, and it primarily touches the
> writeback path for zoned devices and compressed writes. A bad fix could leave
> the TOWRITE tag set too long or clear it incorrectly, causing writeback to
> stall or ordered extents to be mishandled during heavy concurrent
> writepages() activity. Systems not using btrfs, or running btrfs where the
> page size equals the block size (for example, standard 4K-page x86_64 with the
> default 4K block size), are not exercised by this change.
>
> [ Other Info ]
>
> Kybele flow-v12-16-g3521c8c5. Reference: 75f4970b/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260922/fecd5d6c/attachment-0001.sig>