diff mbox

btrfs: fix use-after-free of cmp workspace pages

Message ID 20180713140720.4390-1-naota@elisp.net (mailing list archive)
State New, archived
Headers show

Commit Message

Naohiro Aota July 13, 2018, 2:07 p.m. UTC 
btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves
their page address intact. Now, if you hit "goto again" in
btrfs_extent_same_range() and hit some error in
btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages.

This is simple fix to reset the address to avoid use-after-free.

Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
Signed-off-by: Naohiro Aota <naota@elisp.net>
---
 fs/btrfs/ioctl.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

David Sterba July 13, 2018, 3:30 p.m. UTC | #1 
On Fri, Jul 13, 2018 at 11:07:20PM +0900, Naohiro Aota wrote:
> btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves
> their page address intact. Now, if you hit "goto again" in
> btrfs_extent_same_range() and hit some error in
> btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages.
> 
> This is simple fix to reset the address to avoid use-after-free.
> 
> Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
> Signed-off-by: Naohiro Aota <naota@elisp.net>

Thanks for catching it.

Reviewed-by: David Sterba <dsterba@suse.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 43ecbe620dea..b077544b5232 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3327,11 +3327,13 @@  static void btrfs_cmp_data_free(struct cmp_pages *cmp)
 		if (pg) {
 			unlock_page(pg);
 			put_page(pg);
+			cmp->src_pages[i] = NULL;
 		}
 		pg = cmp->dst_pages[i];
 		if (pg) {
 			unlock_page(pg);
 			put_page(pg);
+			cmp->dst_pages[i] = NULL;
 		}
 	}
 }