From patchwork Fri Jul 13 14:07:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Naohiro Aota X-Patchwork-Id: 10523407 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B02DA6032C for ; Fri, 13 Jul 2018 14:07:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9FA33298AD for ; Fri, 13 Jul 2018 14:07:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 93F2D298C5; Fri, 13 Jul 2018 14:07:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E8A19298D8 for ; Fri, 13 Jul 2018 14:07:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730110AbeGMOWo (ORCPT ); Fri, 13 Jul 2018 10:22:44 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:40027 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729783AbeGMOWo (ORCPT ); Fri, 13 Jul 2018 10:22:44 -0400 Received: by mail-pl0-f67.google.com with SMTP id s17-v6so2862703plp.7 for ; Fri, 13 Jul 2018 07:07:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=FC6pP3kHfy+InbKzsmBCcZxgtWnvwsJkIqVUa5NehiQ=; b=uyc4HLQ3wvhPaR3hRu7iZXjhXWfG45+kFtYKfT4O2X7pw66Ta8b8yv05GEqhdgGxaB No1dRBjEv84dYg9AwgTqD0Ya7nBnq6WdTm09JdaulO437BVtr7iPymeK8lBGLRzSobNm RSSToHqkdaL5pkYgKE3TZgzJK1f1/EZxsL2jIDCMu+YNtg7BxDyVup8sAAHyaKHzFG2l hxknVcJL0xw1Y07ZeyccAemAn+h6kB19Aq8dh+8x17A8KOkOzTLQd+VKYfLAtcdI5bG/ XpxDr026l6fzHuN4yq6sIsv/MFsC1kh1ZmMpQgy5LssomCLvME1Ka6pXMqsqiO0a9sIv BYjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=FC6pP3kHfy+InbKzsmBCcZxgtWnvwsJkIqVUa5NehiQ=; b=PQYSbAn4TzcCb0xzeGAvHjOVwVGCOCVpXCr83I4qgE5vsU+9vn0uIl9PQ1HpbBEPbD JF+Ma6mA+qKLx4aTXYCPV6a4FHdUybUqZw66m3+Sxx6bDSH/162swKZg/NAzkgG/pEos QWyTjejGY1iFsTle68fZ7JFG+XPGC31LOav9bhJIEYB8lYcT21vO99DVOYDioLbwHLNE z9Zw/DQ3LWXNCHjp2Ygu+Bdje4qZLrpZUNvEfIMvX4DpD4LgkOkuqO6xfmc+FRyZukaA 1NVwwSO5oiAGMXNT2lOUF1z3EdWRnDaYVfvpinlzedSo8CVwTmLR4FsmMszzYNUE3PXZ hrWA== X-Gm-Message-State: AOUpUlHdZTS2YClBEmBfnC9nVYoYJZdRJ3xmV+p6OkTfFdo6uVKXEame bLHT6KKCfpRmXsX503Tg51+wvXMJ X-Google-Smtp-Source: AAOMgpfGzvbCmx+aeKgmQHiaWMiIXeeuvvfNcMvrQA2B5LHlUZ7LUL1P9MhzUBmu/4EUmWlyEMEbgg== X-Received: by 2002:a17:902:18a:: with SMTP id b10-v6mr6727004plb.62.1531490876060; Fri, 13 Jul 2018 07:07:56 -0700 (PDT) Received: from ako.hgst.com ([199.255.47.5]) by smtp.gmail.com with ESMTPSA id v82-v6sm44071986pfd.64.2018.07.13.07.07.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 13 Jul 2018 07:07:55 -0700 (PDT) From: Naohiro Aota To: linux-btrfs@vger.kernel.org, dsterba@suse.com Cc: jbacik@fb.com, clm@fb.com, Naohiro Aota Subject: [PATCH] btrfs: fix use-after-free of cmp workspace pages Date: Fri, 13 Jul 2018 23:07:20 +0900 Message-Id: <20180713140720.4390-1-naota@elisp.net> X-Mailer: git-send-email 2.18.0 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves their page address intact. Now, if you hit "goto again" in btrfs_extent_same_range() and hit some error in btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages. This is simple fix to reset the address to avoid use-after-free. Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl") Signed-off-by: Naohiro Aota Reviewed-by: David Sterba --- fs/btrfs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 43ecbe620dea..b077544b5232 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -3327,11 +3327,13 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp) if (pg) { unlock_page(pg); put_page(pg); + cmp->src_pages[i] = NULL; } pg = cmp->dst_pages[i]; if (pg) { unlock_page(pg); put_page(pg); + cmp->dst_pages[i] = NULL; } } }