btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
diff mbox

Message ID 20180702062538.30794-1-wqu@suse.com
State New
Headers show

Commit Message

Qu Wenruo July 2, 2018, 6:25 a.m. UTC
Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
invalid tree reloc tree can cause kernel NULL pointer dereference when
btrfs does some cleanup for reloc roots.

It turns out that fs_info->reloc_ctl can be NULL in
btrfs_recover_relocation() as we allocate relocation control after all
reloc roots are verified.
So when we hit out: tag, we haven't call set_reloc_control() thus
fs_info->reloc_ctl is still NULL.

Reported-by: Xu Wen <wen.xu@gatech.edu>
Signed-off-by: Qu Wenruo <wqu@suse.com>
---
 fs/btrfs/relocation.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

Comments

Nikolay Borisov July 2, 2018, 7:31 a.m. UTC | #1
On  2.07.2018 09:25, Qu Wenruo wrote:
> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
> invalid tree reloc tree can cause kernel NULL pointer dereference when
> btrfs does some cleanup for reloc roots.
> 
> It turns out that fs_info->reloc_ctl can be NULL in
> btrfs_recover_relocation() as we allocate relocation control after all
> reloc roots are verified.
> So when we hit out: tag, we haven't call set_reloc_control() thus
> fs_info->reloc_ctl is still NULL.
> 
> Reported-by: Xu Wen <wen.xu@gatech.edu>
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>  1 file changed, 12 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index 879b76fa881a..be94c65bb4d2 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>  	struct mapping_node *node = NULL;
>  	struct reloc_control *rc = fs_info->reloc_ctl;
>  > -	spin_lock(&rc->reloc_root_tree.lock);
> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
> -			      root->node->start);
> -	if (rb_node) {
> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);

Just do  if (!rc)
                return;

The function is simple enough, no need to indent multiple lines.
> +	if (rc) {
> +		spin_lock(&rc->reloc_root_tree.lock);
> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
> +				      root->node->start);
> +		if (rb_node) {
> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
> +		}
> +		spin_unlock(&rc->reloc_root_tree.lock);
> +		if (!node)
> +			return;
> +		BUG_ON((struct btrfs_root *)node->data != root);
>  	}
> -	spin_unlock(&rc->reloc_root_tree.lock);
> -
> -	if (!node)
> -		return;
> -	BUG_ON((struct btrfs_root *)node->data != root);
>  
>  	spin_lock(&fs_info->trans_lock);
>  	list_del_init(&root->root_list);
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Qu Wenruo July 2, 2018, 7:53 a.m. UTC | #2
On 2018年07月02日 15:31, Nikolay Borisov wrote:
> 
> 
> On  2.07.2018 09:25, Qu Wenruo wrote:
>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
>> invalid tree reloc tree can cause kernel NULL pointer dereference when
>> btrfs does some cleanup for reloc roots.
>>
>> It turns out that fs_info->reloc_ctl can be NULL in
>> btrfs_recover_relocation() as we allocate relocation control after all
>> reloc roots are verified.
>> So when we hit out: tag, we haven't call set_reloc_control() thus
>> fs_info->reloc_ctl is still NULL.
>>
>> Reported-by: Xu Wen <wen.xu@gatech.edu>
>> Signed-off-by: Qu Wenruo <wqu@suse.com>
>> ---
>>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>>  1 file changed, 12 insertions(+), 11 deletions(-)
>>
>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>> index 879b76fa881a..be94c65bb4d2 100644
>> --- a/fs/btrfs/relocation.c
>> +++ b/fs/btrfs/relocation.c
>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>>  	struct mapping_node *node = NULL;
>>  	struct reloc_control *rc = fs_info->reloc_ctl;
>>  > -	spin_lock(&rc->reloc_root_tree.lock);
>> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>> -			      root->node->start);
>> -	if (rb_node) {
>> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
>> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
> 
> Just do  if (!rc)
>                 return;
> 
> The function is simple enough, no need to indent multiple lines.

You missed serval lines below, we still have:
---
        spin_lock(&fs_info->trans_lock);
        list_del_init(&root->root_list);
        spin_unlock(&fs_info->trans_lock);
        kfree(node);
---

Which still needs to be called even rc is not initialized.

Thanks,
Qu

>> +	if (rc) {
>> +		spin_lock(&rc->reloc_root_tree.lock);
>> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>> +				      root->node->start);
>> +		if (rb_node) {
>> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
>> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>> +		}
>> +		spin_unlock(&rc->reloc_root_tree.lock);
>> +		if (!node)
>> +			return;
>> +		BUG_ON((struct btrfs_root *)node->data != root);
>>  	}
>> -	spin_unlock(&rc->reloc_root_tree.lock);
>> -
>> -	if (!node)
>> -		return;
>> -	BUG_ON((struct btrfs_root *)node->data != root);
>>  
>>  	spin_lock(&fs_info->trans_lock);
>>  	list_del_init(&root->root_list);
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Nikolay Borisov July 2, 2018, 8:01 a.m. UTC | #3
On  2.07.2018 10:53, Qu Wenruo wrote:
> 
> 
> On 2018年07月02日 15:31, Nikolay Borisov wrote:
>>
>>
>> On  2.07.2018 09:25, Qu Wenruo wrote:
>>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
>>> invalid tree reloc tree can cause kernel NULL pointer dereference when
>>> btrfs does some cleanup for reloc roots.
>>>
>>> It turns out that fs_info->reloc_ctl can be NULL in
>>> btrfs_recover_relocation() as we allocate relocation control after all
>>> reloc roots are verified.
>>> So when we hit out: tag, we haven't call set_reloc_control() thus
>>> fs_info->reloc_ctl is still NULL.
>>>
>>> Reported-by: Xu Wen <wen.xu@gatech.edu>
>>> Signed-off-by: Qu Wenruo <wqu@suse.com>
>>> ---
>>>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>>>  1 file changed, 12 insertions(+), 11 deletions(-)
>>>
>>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>>> index 879b76fa881a..be94c65bb4d2 100644
>>> --- a/fs/btrfs/relocation.c
>>> +++ b/fs/btrfs/relocation.c
>>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>>>  	struct mapping_node *node = NULL;
>>>  	struct reloc_control *rc = fs_info->reloc_ctl;
>>>  > -	spin_lock(&rc->reloc_root_tree.lock);
>>> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>> -			      root->node->start);
>>> -	if (rb_node) {
>>> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
>>> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>
>> Just do  if (!rc)
>>                 return;
>>
>> The function is simple enough, no need to indent multiple lines.
> 
> You missed serval lines below, we still have:
> ---
>         spin_lock(&fs_info->trans_lock);
>         list_del_init(&root->root_list);
>         spin_unlock(&fs_info->trans_lock);
>         kfree(node);
> ---
> 
> Which still needs to be called even rc is not initialized.

But then isn't the function buggy even with your patch because if node
is not initialised then we exit at if (!node) return.
> 
> Thanks,
> Qu
> 
>>> +	if (rc) {
>>> +		spin_lock(&rc->reloc_root_tree.lock);
>>> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>> +				      root->node->start);
>>> +		if (rb_node) {
>>> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
>>> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>> +		}
>>> +		spin_unlock(&rc->reloc_root_tree.lock);
>>> +		if (!node)
>>> +			return;
>>> +		BUG_ON((struct btrfs_root *)node->data != root);
>>>  	}
>>> -	spin_unlock(&rc->reloc_root_tree.lock);
>>> -
>>> -	if (!node)
>>> -		return;
>>> -	BUG_ON((struct btrfs_root *)node->data != root);
>>>  
>>>  	spin_lock(&fs_info->trans_lock);
>>>  	list_del_init(&root->root_list);
>>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Nikolay Borisov July 2, 2018, 8:05 a.m. UTC | #4
On  2.07.2018 11:01, Nikolay Borisov wrote:
> 
> 
> On  2.07.2018 10:53, Qu Wenruo wrote:
>>
>>
>> On 2018年07月02日 15:31, Nikolay Borisov wrote:
>>>
>>>
>>> On  2.07.2018 09:25, Qu Wenruo wrote:
>>>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
>>>> invalid tree reloc tree can cause kernel NULL pointer dereference when
>>>> btrfs does some cleanup for reloc roots.
>>>>
>>>> It turns out that fs_info->reloc_ctl can be NULL in
>>>> btrfs_recover_relocation() as we allocate relocation control after all
>>>> reloc roots are verified.
>>>> So when we hit out: tag, we haven't call set_reloc_control() thus
>>>> fs_info->reloc_ctl is still NULL.
>>>>
>>>> Reported-by: Xu Wen <wen.xu@gatech.edu>
>>>> Signed-off-by: Qu Wenruo <wqu@suse.com>
>>>> ---
>>>>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>>>>  1 file changed, 12 insertions(+), 11 deletions(-)
>>>>
>>>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>>>> index 879b76fa881a..be94c65bb4d2 100644
>>>> --- a/fs/btrfs/relocation.c
>>>> +++ b/fs/btrfs/relocation.c
>>>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>>>>  	struct mapping_node *node = NULL;
>>>>  	struct reloc_control *rc = fs_info->reloc_ctl;
>>>>  > -	spin_lock(&rc->reloc_root_tree.lock);
>>>> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>>> -			      root->node->start);
>>>> -	if (rb_node) {
>>>> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
>>>> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>>
>>> Just do  if (!rc)
>>>                 return;
>>>
>>> The function is simple enough, no need to indent multiple lines.
>>
>> You missed serval lines below, we still have:
>> ---
>>         spin_lock(&fs_info->trans_lock);
>>         list_del_init(&root->root_list);
>>         spin_unlock(&fs_info->trans_lock);
>>         kfree(node);
>> ---
>>
>> Which still needs to be called even rc is not initialized.
> 
> But then isn't the function buggy even with your patch because if node
> is not initialised then we exit at if (!node) return.

Ah, so you've moved the if (!node) check inside the if (rc) branch. Then
it will work as you said. Fair enough.

>>


>> Thanks,
>> Qu
>>
>>>> +	if (rc) {
>>>> +		spin_lock(&rc->reloc_root_tree.lock);
>>>> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>>> +				      root->node->start);
>>>> +		if (rb_node) {
>>>> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
>>>> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>>> +		}
>>>> +		spin_unlock(&rc->reloc_root_tree.lock);
>>>> +		if (!node)
>>>> +			return;
>>>> +		BUG_ON((struct btrfs_root *)node->data != root);
>>>>  	}
>>>> -	spin_unlock(&rc->reloc_root_tree.lock);
>>>> -
>>>> -	if (!node)
>>>> -		return;
>>>> -	BUG_ON((struct btrfs_root *)node->data != root);
>>>>  
>>>>  	spin_lock(&fs_info->trans_lock);
>>>>  	list_del_init(&root->root_list);
>>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>>
>>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Qu Wenruo July 2, 2018, 8:14 a.m. UTC | #5
On 2018年07月02日 16:01, Nikolay Borisov wrote:
> 
> 
> On  2.07.2018 10:53, Qu Wenruo wrote:
>>
>>
>> On 2018年07月02日 15:31, Nikolay Borisov wrote:
>>>
>>>
>>> On  2.07.2018 09:25, Qu Wenruo wrote:
>>>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
>>>> invalid tree reloc tree can cause kernel NULL pointer dereference when
>>>> btrfs does some cleanup for reloc roots.
>>>>
>>>> It turns out that fs_info->reloc_ctl can be NULL in
>>>> btrfs_recover_relocation() as we allocate relocation control after all
>>>> reloc roots are verified.
>>>> So when we hit out: tag, we haven't call set_reloc_control() thus
>>>> fs_info->reloc_ctl is still NULL.
>>>>
>>>> Reported-by: Xu Wen <wen.xu@gatech.edu>
>>>> Signed-off-by: Qu Wenruo <wqu@suse.com>
>>>> ---
>>>>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>>>>  1 file changed, 12 insertions(+), 11 deletions(-)
>>>>
>>>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>>>> index 879b76fa881a..be94c65bb4d2 100644
>>>> --- a/fs/btrfs/relocation.c
>>>> +++ b/fs/btrfs/relocation.c
>>>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>>>>  	struct mapping_node *node = NULL;
>>>>  	struct reloc_control *rc = fs_info->reloc_ctl;
>>>>  > -	spin_lock(&rc->reloc_root_tree.lock);
>>>> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>>> -			      root->node->start);
>>>> -	if (rb_node) {
>>>> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
>>>> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>>
>>> Just do  if (!rc)
>>>                 return;
>>>
>>> The function is simple enough, no need to indent multiple lines.
>>
>> You missed serval lines below, we still have:
>> ---
>>         spin_lock(&fs_info->trans_lock);
>>         list_del_init(&root->root_list);
>>         spin_unlock(&fs_info->trans_lock);
>>         kfree(node);
>> ---
>>
>> Which still needs to be called even rc is not initialized.
> 
> But then isn't the function buggy even with your patch because if node
> is not initialised then we exit at if (!node) return.

That means node->data isn't initialized nor its root->root_list.

The patch only needs to call list_del_init() if @rc is not initialized.

Thanks,
Qu

>>
>> Thanks,
>> Qu
>>
>>>> +	if (rc) {
>>>> +		spin_lock(&rc->reloc_root_tree.lock);
>>>> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>>>> +				      root->node->start);
>>>> +		if (rb_node) {
>>>> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
>>>> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>>>> +		}
>>>> +		spin_unlock(&rc->reloc_root_tree.lock);
>>>> +		if (!node)
>>>> +			return;
>>>> +		BUG_ON((struct btrfs_root *)node->data != root);
>>>>  	}
>>>> -	spin_unlock(&rc->reloc_root_tree.lock);
>>>> -
>>>> -	if (!node)
>>>> -		return;
>>>> -	BUG_ON((struct btrfs_root *)node->data != root);
>>>>  
>>>>  	spin_lock(&fs_info->trans_lock);
>>>>  	list_del_init(&root->root_list);
>>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>>
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Sterba July 2, 2018, 3:58 p.m. UTC | #6
On Mon, Jul 02, 2018 at 02:25:38PM +0800, Qu Wenruo wrote:
> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
> invalid tree reloc tree can cause kernel NULL pointer dereference when
> btrfs does some cleanup for reloc roots.
> 
> It turns out that fs_info->reloc_ctl can be NULL in
> btrfs_recover_relocation() as we allocate relocation control after all
> reloc roots are verified.
> So when we hit out: tag, we haven't call set_reloc_control() thus
> fs_info->reloc_ctl is still NULL.
> 
> Reported-by: Xu Wen <wen.xu@gatech.edu>
> Signed-off-by: Qu Wenruo <wqu@suse.com>

Thanks for the fix, patch added to the queue. I've added the fuzzed
image from bugzilla to btrfs-progs.
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 879b76fa881a..be94c65bb4d2 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1321,18 +1321,19 @@  static void __del_reloc_root(struct btrfs_root *root)
 	struct mapping_node *node = NULL;
 	struct reloc_control *rc = fs_info->reloc_ctl;
 
-	spin_lock(&rc->reloc_root_tree.lock);
-	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
-			      root->node->start);
-	if (rb_node) {
-		node = rb_entry(rb_node, struct mapping_node, rb_node);
-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+	if (rc) {
+		spin_lock(&rc->reloc_root_tree.lock);
+		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+				      root->node->start);
+		if (rb_node) {
+			node = rb_entry(rb_node, struct mapping_node, rb_node);
+			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+		}
+		spin_unlock(&rc->reloc_root_tree.lock);
+		if (!node)
+			return;
+		BUG_ON((struct btrfs_root *)node->data != root);
 	}
-	spin_unlock(&rc->reloc_root_tree.lock);
-
-	if (!node)
-		return;
-	BUG_ON((struct btrfs_root *)node->data != root);
 
 	spin_lock(&fs_info->trans_lock);
 	list_del_init(&root->root_list);