| Message ID | 20240830224536.64932-1-brennan.lamoreaux@broadcom.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [6.1.y] btrfs: fix extent map use-after-free when adding pages to compressed bio | expand |
On Fri, Aug 30, 2024 at 03:45:36PM -0700, Brennan Lamoreaux wrote: > From: Filipe Manana <fdmanana@suse.com> > > commit 8e7860543a94784d744c7ce34b78a2e11beefa5c upstream. > > At add_ra_bio_pages() we are accessing the extent map to calculate > 'add_size' after we dropped our reference on the extent map, resulting > in a use-after-free. Fix this by computing 'add_size' before dropping our > extent map reference. > > Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com > Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/ > Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible") > CC: stable@vger.kernel.org # 6.1+ > Signed-off-by: Filipe Manana <fdmanana@suse.com> > Reviewed-by: David Sterba <dsterba@suse.com> > Signed-off-by: David Sterba <dsterba@suse.com> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > [ Brennan: Applied to v6.1 ] > Signed-off-by: Brennan Lamoreaux <brennan.lamoreaux@broadcom.com> > --- > fs/btrfs/compression.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Now queued up, thanks. greg k-h
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c index e6635fe70067..cb56ac8b925e 100644 --- a/fs/btrfs/compression.c +++ b/fs/btrfs/compression.c @@ -613,6 +613,7 @@ static noinline int add_ra_bio_pages(struct inode *inode, put_page(page); break; } + add_size = min(em->start + em->len, page_end + 1) - cur; free_extent_map(em); if (page->index == end_index) { @@ -625,7 +626,6 @@ static noinline int add_ra_bio_pages(struct inode *inode, } } - add_size = min(em->start + em->len, page_end + 1) - cur; ret = bio_add_page(cb->orig_bio, page, add_size, offset_in_page(cur)); if (ret != add_size) { unlock_extent(tree, cur, page_end, NULL);