| Message ID | 20180702062538.30794-1-wqu@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 2.07.2018 09:25, Qu Wenruo wrote: > Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an > invalid tree reloc tree can cause kernel NULL pointer dereference when > btrfs does some cleanup for reloc roots. > > It turns out that fs_info->reloc_ctl can be NULL in > btrfs_recover_relocation() as we allocate relocation control after all > reloc roots are verified. > So when we hit out: tag, we haven't call set_reloc_control() thus > fs_info->reloc_ctl is still NULL. > > Reported-by: Xu Wen <wen.xu@gatech.edu> > Signed-off-by: Qu Wenruo <wqu@suse.com> > --- > fs/btrfs/relocation.c | 23 ++++++++++++----------- > 1 file changed, 12 insertions(+), 11 deletions(-) > > diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c > index 879b76fa881a..be94c65bb4d2 100644 > --- a/fs/btrfs/relocation.c > +++ b/fs/btrfs/relocation.c > @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) > struct mapping_node *node = NULL; > struct reloc_control *rc = fs_info->reloc_ctl; > > - spin_lock(&rc->reloc_root_tree.lock); > - rb_node = tree_search(&rc->reloc_root_tree.rb_root, > - root->node->start); > - if (rb_node) { > - node = rb_entry(rb_node, struct mapping_node, rb_node); > - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); Just do if (!rc) return; The function is simple enough, no need to indent multiple lines. > + if (rc) { > + spin_lock(&rc->reloc_root_tree.lock); > + rb_node = tree_search(&rc->reloc_root_tree.rb_root, > + root->node->start); > + if (rb_node) { > + node = rb_entry(rb_node, struct mapping_node, rb_node); > + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); > + } > + spin_unlock(&rc->reloc_root_tree.lock); > + if (!node) > + return; > + BUG_ON((struct btrfs_root *)node->data != root); > } > - spin_unlock(&rc->reloc_root_tree.lock); > - > - if (!node) > - return; > - BUG_ON((struct btrfs_root *)node->data != root); > > spin_lock(&fs_info->trans_lock); > list_del_init(&root->root_list); > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2018年07月02日 15:31, Nikolay Borisov wrote: > > > On 2.07.2018 09:25, Qu Wenruo wrote: >> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >> invalid tree reloc tree can cause kernel NULL pointer dereference when >> btrfs does some cleanup for reloc roots. >> >> It turns out that fs_info->reloc_ctl can be NULL in >> btrfs_recover_relocation() as we allocate relocation control after all >> reloc roots are verified. >> So when we hit out: tag, we haven't call set_reloc_control() thus >> fs_info->reloc_ctl is still NULL. >> >> Reported-by: Xu Wen <wen.xu@gatech.edu> >> Signed-off-by: Qu Wenruo <wqu@suse.com> >> --- >> fs/btrfs/relocation.c | 23 ++++++++++++----------- >> 1 file changed, 12 insertions(+), 11 deletions(-) >> >> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >> index 879b76fa881a..be94c65bb4d2 100644 >> --- a/fs/btrfs/relocation.c >> +++ b/fs/btrfs/relocation.c >> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >> struct mapping_node *node = NULL; >> struct reloc_control *rc = fs_info->reloc_ctl; >> > - spin_lock(&rc->reloc_root_tree.lock); >> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >> - root->node->start); >> - if (rb_node) { >> - node = rb_entry(rb_node, struct mapping_node, rb_node); >> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); > > Just do if (!rc) > return; > > The function is simple enough, no need to indent multiple lines. You missed serval lines below, we still have: --- spin_lock(&fs_info->trans_lock); list_del_init(&root->root_list); spin_unlock(&fs_info->trans_lock); kfree(node); --- Which still needs to be called even rc is not initialized. Thanks, Qu >> + if (rc) { >> + spin_lock(&rc->reloc_root_tree.lock); >> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >> + root->node->start); >> + if (rb_node) { >> + node = rb_entry(rb_node, struct mapping_node, rb_node); >> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >> + } >> + spin_unlock(&rc->reloc_root_tree.lock); >> + if (!node) >> + return; >> + BUG_ON((struct btrfs_root *)node->data != root); >> } >> - spin_unlock(&rc->reloc_root_tree.lock); >> - >> - if (!node) >> - return; >> - BUG_ON((struct btrfs_root *)node->data != root); >> >> spin_lock(&fs_info->trans_lock); >> list_del_init(&root->root_list); >> > -- > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2.07.2018 10:53, Qu Wenruo wrote: > > > On 2018年07月02日 15:31, Nikolay Borisov wrote: >> >> >> On 2.07.2018 09:25, Qu Wenruo wrote: >>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >>> invalid tree reloc tree can cause kernel NULL pointer dereference when >>> btrfs does some cleanup for reloc roots. >>> >>> It turns out that fs_info->reloc_ctl can be NULL in >>> btrfs_recover_relocation() as we allocate relocation control after all >>> reloc roots are verified. >>> So when we hit out: tag, we haven't call set_reloc_control() thus >>> fs_info->reloc_ctl is still NULL. >>> >>> Reported-by: Xu Wen <wen.xu@gatech.edu> >>> Signed-off-by: Qu Wenruo <wqu@suse.com> >>> --- >>> fs/btrfs/relocation.c | 23 ++++++++++++----------- >>> 1 file changed, 12 insertions(+), 11 deletions(-) >>> >>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >>> index 879b76fa881a..be94c65bb4d2 100644 >>> --- a/fs/btrfs/relocation.c >>> +++ b/fs/btrfs/relocation.c >>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >>> struct mapping_node *node = NULL; >>> struct reloc_control *rc = fs_info->reloc_ctl; >>> > - spin_lock(&rc->reloc_root_tree.lock); >>> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>> - root->node->start); >>> - if (rb_node) { >>> - node = rb_entry(rb_node, struct mapping_node, rb_node); >>> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >> >> Just do if (!rc) >> return; >> >> The function is simple enough, no need to indent multiple lines. > > You missed serval lines below, we still have: > --- > spin_lock(&fs_info->trans_lock); > list_del_init(&root->root_list); > spin_unlock(&fs_info->trans_lock); > kfree(node); > --- > > Which still needs to be called even rc is not initialized. But then isn't the function buggy even with your patch because if node is not initialised then we exit at if (!node) return. > > Thanks, > Qu > >>> + if (rc) { >>> + spin_lock(&rc->reloc_root_tree.lock); >>> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>> + root->node->start); >>> + if (rb_node) { >>> + node = rb_entry(rb_node, struct mapping_node, rb_node); >>> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>> + } >>> + spin_unlock(&rc->reloc_root_tree.lock); >>> + if (!node) >>> + return; >>> + BUG_ON((struct btrfs_root *)node->data != root); >>> } >>> - spin_unlock(&rc->reloc_root_tree.lock); >>> - >>> - if (!node) >>> - return; >>> - BUG_ON((struct btrfs_root *)node->data != root); >>> >>> spin_lock(&fs_info->trans_lock); >>> list_del_init(&root->root_list); >>> >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2.07.2018 11:01, Nikolay Borisov wrote: > > > On 2.07.2018 10:53, Qu Wenruo wrote: >> >> >> On 2018年07月02日 15:31, Nikolay Borisov wrote: >>> >>> >>> On 2.07.2018 09:25, Qu Wenruo wrote: >>>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >>>> invalid tree reloc tree can cause kernel NULL pointer dereference when >>>> btrfs does some cleanup for reloc roots. >>>> >>>> It turns out that fs_info->reloc_ctl can be NULL in >>>> btrfs_recover_relocation() as we allocate relocation control after all >>>> reloc roots are verified. >>>> So when we hit out: tag, we haven't call set_reloc_control() thus >>>> fs_info->reloc_ctl is still NULL. >>>> >>>> Reported-by: Xu Wen <wen.xu@gatech.edu> >>>> Signed-off-by: Qu Wenruo <wqu@suse.com> >>>> --- >>>> fs/btrfs/relocation.c | 23 ++++++++++++----------- >>>> 1 file changed, 12 insertions(+), 11 deletions(-) >>>> >>>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >>>> index 879b76fa881a..be94c65bb4d2 100644 >>>> --- a/fs/btrfs/relocation.c >>>> +++ b/fs/btrfs/relocation.c >>>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >>>> struct mapping_node *node = NULL; >>>> struct reloc_control *rc = fs_info->reloc_ctl; >>>> > - spin_lock(&rc->reloc_root_tree.lock); >>>> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>>> - root->node->start); >>>> - if (rb_node) { >>>> - node = rb_entry(rb_node, struct mapping_node, rb_node); >>>> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>> >>> Just do if (!rc) >>> return; >>> >>> The function is simple enough, no need to indent multiple lines. >> >> You missed serval lines below, we still have: >> --- >> spin_lock(&fs_info->trans_lock); >> list_del_init(&root->root_list); >> spin_unlock(&fs_info->trans_lock); >> kfree(node); >> --- >> >> Which still needs to be called even rc is not initialized. > > But then isn't the function buggy even with your patch because if node > is not initialised then we exit at if (!node) return. Ah, so you've moved the if (!node) check inside the if (rc) branch. Then it will work as you said. Fair enough. >> >> Thanks, >> Qu >> >>>> + if (rc) { >>>> + spin_lock(&rc->reloc_root_tree.lock); >>>> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>>> + root->node->start); >>>> + if (rb_node) { >>>> + node = rb_entry(rb_node, struct mapping_node, rb_node); >>>> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>>> + } >>>> + spin_unlock(&rc->reloc_root_tree.lock); >>>> + if (!node) >>>> + return; >>>> + BUG_ON((struct btrfs_root *)node->data != root); >>>> } >>>> - spin_unlock(&rc->reloc_root_tree.lock); >>>> - >>>> - if (!node) >>>> - return; >>>> - BUG_ON((struct btrfs_root *)node->data != root); >>>> >>>> spin_lock(&fs_info->trans_lock); >>>> list_del_init(&root->root_list); >>>> >>> -- >>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in >>> the body of a message to majordomo@vger.kernel.org >>> More majordomo info at http://vger.kernel.org/majordomo-info.html >>> >> -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2018年07月02日 16:01, Nikolay Borisov wrote: > > > On 2.07.2018 10:53, Qu Wenruo wrote: >> >> >> On 2018年07月02日 15:31, Nikolay Borisov wrote: >>> >>> >>> On 2.07.2018 09:25, Qu Wenruo wrote: >>>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >>>> invalid tree reloc tree can cause kernel NULL pointer dereference when >>>> btrfs does some cleanup for reloc roots. >>>> >>>> It turns out that fs_info->reloc_ctl can be NULL in >>>> btrfs_recover_relocation() as we allocate relocation control after all >>>> reloc roots are verified. >>>> So when we hit out: tag, we haven't call set_reloc_control() thus >>>> fs_info->reloc_ctl is still NULL. >>>> >>>> Reported-by: Xu Wen <wen.xu@gatech.edu> >>>> Signed-off-by: Qu Wenruo <wqu@suse.com> >>>> --- >>>> fs/btrfs/relocation.c | 23 ++++++++++++----------- >>>> 1 file changed, 12 insertions(+), 11 deletions(-) >>>> >>>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >>>> index 879b76fa881a..be94c65bb4d2 100644 >>>> --- a/fs/btrfs/relocation.c >>>> +++ b/fs/btrfs/relocation.c >>>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >>>> struct mapping_node *node = NULL; >>>> struct reloc_control *rc = fs_info->reloc_ctl; >>>> > - spin_lock(&rc->reloc_root_tree.lock); >>>> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>>> - root->node->start); >>>> - if (rb_node) { >>>> - node = rb_entry(rb_node, struct mapping_node, rb_node); >>>> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>> >>> Just do if (!rc) >>> return; >>> >>> The function is simple enough, no need to indent multiple lines. >> >> You missed serval lines below, we still have: >> --- >> spin_lock(&fs_info->trans_lock); >> list_del_init(&root->root_list); >> spin_unlock(&fs_info->trans_lock); >> kfree(node); >> --- >> >> Which still needs to be called even rc is not initialized. > > But then isn't the function buggy even with your patch because if node > is not initialised then we exit at if (!node) return. That means node->data isn't initialized nor its root->root_list. The patch only needs to call list_del_init() if @rc is not initialized. Thanks, Qu >> >> Thanks, >> Qu >> >>>> + if (rc) { >>>> + spin_lock(&rc->reloc_root_tree.lock); >>>> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>>> + root->node->start); >>>> + if (rb_node) { >>>> + node = rb_entry(rb_node, struct mapping_node, rb_node); >>>> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>>> + } >>>> + spin_unlock(&rc->reloc_root_tree.lock); >>>> + if (!node) >>>> + return; >>>> + BUG_ON((struct btrfs_root *)node->data != root); >>>> } >>>> - spin_unlock(&rc->reloc_root_tree.lock); >>>> - >>>> - if (!node) >>>> - return; >>>> - BUG_ON((struct btrfs_root *)node->data != root); >>>> >>>> spin_lock(&fs_info->trans_lock); >>>> list_del_init(&root->root_list); >>>> >>> -- >>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in >>> the body of a message to majordomo@vger.kernel.org >>> More majordomo info at http://vger.kernel.org/majordomo-info.html >>> >> > -- > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Jul 02, 2018 at 02:25:38PM +0800, Qu Wenruo wrote: > Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an > invalid tree reloc tree can cause kernel NULL pointer dereference when > btrfs does some cleanup for reloc roots. > > It turns out that fs_info->reloc_ctl can be NULL in > btrfs_recover_relocation() as we allocate relocation control after all > reloc roots are verified. > So when we hit out: tag, we haven't call set_reloc_control() thus > fs_info->reloc_ctl is still NULL. > > Reported-by: Xu Wen <wen.xu@gatech.edu> > Signed-off-by: Qu Wenruo <wqu@suse.com> Thanks for the fix, patch added to the queue. I've added the fuzzed image from bugzilla to btrfs-progs. -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 879b76fa881a..be94c65bb4d2 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) struct mapping_node *node = NULL; struct reloc_control *rc = fs_info->reloc_ctl; - spin_lock(&rc->reloc_root_tree.lock); - rb_node = tree_search(&rc->reloc_root_tree.rb_root, - root->node->start); - if (rb_node) { - node = rb_entry(rb_node, struct mapping_node, rb_node); - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); + if (rc) { + spin_lock(&rc->reloc_root_tree.lock); + rb_node = tree_search(&rc->reloc_root_tree.rb_root, + root->node->start); + if (rb_node) { + node = rb_entry(rb_node, struct mapping_node, rb_node); + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); + } + spin_unlock(&rc->reloc_root_tree.lock); + if (!node) + return; + BUG_ON((struct btrfs_root *)node->data != root); } - spin_unlock(&rc->reloc_root_tree.lock); - - if (!node) - return; - BUG_ON((struct btrfs_root *)node->data != root); spin_lock(&fs_info->trans_lock); list_del_init(&root->root_list);
Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an invalid tree reloc tree can cause kernel NULL pointer dereference when btrfs does some cleanup for reloc roots. It turns out that fs_info->reloc_ctl can be NULL in btrfs_recover_relocation() as we allocate relocation control after all reloc roots are verified. So when we hit out: tag, we haven't call set_reloc_control() thus fs_info->reloc_ctl is still NULL. Reported-by: Xu Wen <wen.xu@gatech.edu> Signed-off-by: Qu Wenruo <wqu@suse.com> --- fs/btrfs/relocation.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)