Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btree_writepages() holds fs_info->zoned_meta_io_lock across the whole writeback loop, including the call to btrfs_check_meta_write_pointer() -> check_bg_is_active(). For the tree-log block group, check_bg_is_active() may fail to activate the zone and fall back to btrfs_zone_finish_one_bg() to free an active zone. That path waits for the running transaction to commit while still holding zoned_meta_io_lock, but the committer needs that same lock to write out the tree extents, so the two tasks deadlock: Task A (kworker, metadata writeback) Task B (fsstress, transaction commit) ------------------------------------ ------------------------------------- wb_workfn() btrfs_commit_transaction(T) btree_writepages() btrfs_write_and_wait_transaction() btrfs_zoned_meta_io_lock() btrfs_write_marked_extents() btrfs_check_meta_write_pointer() btree_writepages() check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock() btrfs_zone_finish_one_bg() <blocks on zoned_meta_io_lock, btrfs_zone_finish() held by Task A> do_zone_finish() btrfs_inc_block_group_ro() btrfs_wait_for_commit() <blocks waiting for commit of transaction T, done by Task B> The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock around do_zone_finish() for this exact reason. Do the same in the tree-log branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire it afterwards. The lock only protects fs_info->active_{meta,system}_bg, which this branch does not touch, and ctx->zoned_bg keeps a reference to the block group across the unlock, so nothing is lost while the lock is dropped. This hang occasionally reproduces with fstests generic/475 on a zoned btrfs filesystem.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T13:18:02.837Z",
  "pubdate": "2026-08-15T13:18:02.837Z",
  "executiveSummary": "A deadlock vulnerability exists in the Linux kernel Btrfs filesystem implementation when operating on zoned storage devices.\nThe vulnerability involves a classic AB-BA resource locking contention between metadata writeback operations and transaction commits.\nSpecifically, the issue arises during tree-log block group zone management within the btree_writepages() function.\nWhen triggered, it leads to an indefinite hang (denial of service) affecting the affected Linux kernel subsystem, heavily impacting system availability.\nThe flaw can be reproduced locally under specific filesystem workloads such as fstests generic/475.\nNo external attacker capabilities or network exposure are strictly required, as this is a local concurrency and locking bug within kernel space, though local users with the ability to trigger heavy filesystem stress can induce the condition.",
  "technicalDetails": "The root cause of the vulnerability is improper lock ordering and retention during metadata writeback in the Btrfs zoned filesystem driver. Specifically, btree_writepages() acquires fs_info->zoned_meta_io_lock and holds it across the entire writeback loop, including calls to btrfs_check_meta_write_pointer() and check_bg_is_active().\nDuring the processing of the tree-log block group, check_bg_is_active() may fail to activate the zone, subsequently invoking btrfs_zone_finish_one_bg() to free an active zone. Within this execution path, the thread calls btrfs_inc_block_group_ro() which invokes btrfs_wait_for_commit(), waiting for the running transaction to commit while still holding the zoned_meta_io_lock.\nSimultaneously, a concurrent transaction commit task (Task B) executing btrfs_commit_transaction() attempts to write out dirty metadata extents via btrfs_write_and_wait_transaction() and btree_writepages(), which requires acquiring the exact same zoned_meta_io_lock held by Task A.\nThis creates a circular dependency and deadlock: Task A holds zoned_meta_io_lock and blocks waiting for transaction commit completion by Task B, while Task B blocks waiting to acquire zoned_meta_io_lock held by Task A.\nThe vulnerable component is the zoned metadata writeback and zone management logic within the Linux kernel Btrfs filesystem, specifically affecting functions btree_writepages(), check_bg_is_active(), and btrfs_zone_finish_one_bg().\nThe attack or failure flow proceeds as follows: 1) Task A (kworker) initiates metadata writeback, acquiring fs_info->zoned_meta_io_lock. 2) Task A evaluates the tree-log block group in check_bg_is_active() and attempts to finish the zone via btrfs_zone_finish_one_bg(). 3) Task A waits for a transaction commit while retaining the lock. 4) Task B initiates a transaction commit, attempts to write marked extents, and blocks indefinitely waiting for zoned_meta_io_lock.\nPost-exploitation impact is limited to a localized denial of service (system hang / kernel lockup) on systems utilizing zoned Btrfs filesystems under specific I/O workloads."
}