* [PATCH] btrfs: fix use-after-free of cmp workspace pages
@ 2018-07-13 14:07 Naohiro Aota
2018-07-13 15:30 ` David Sterba
0 siblings, 1 reply; 2+ messages in thread
From: Naohiro Aota @ 2018-07-13 14:07 UTC (permalink / raw)
To: linux-btrfs, dsterba; +Cc: jbacik, clm, Naohiro Aota
btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves
their page address intact. Now, if you hit "goto again" in
btrfs_extent_same_range() and hit some error in
btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages.
This is simple fix to reset the address to avoid use-after-free.
Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
Signed-off-by: Naohiro Aota <naota@elisp.net>
---
fs/btrfs/ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 43ecbe620dea..b077544b5232 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3327,11 +3327,13 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp)
if (pg) {
unlock_page(pg);
put_page(pg);
+ cmp->src_pages[i] = NULL;
}
pg = cmp->dst_pages[i];
if (pg) {
unlock_page(pg);
put_page(pg);
+ cmp->dst_pages[i] = NULL;
}
}
}
--
2.18.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] btrfs: fix use-after-free of cmp workspace pages
2018-07-13 14:07 [PATCH] btrfs: fix use-after-free of cmp workspace pages Naohiro Aota
@ 2018-07-13 15:30 ` David Sterba
0 siblings, 0 replies; 2+ messages in thread
From: David Sterba @ 2018-07-13 15:30 UTC (permalink / raw)
To: Naohiro Aota; +Cc: linux-btrfs, dsterba, jbacik, clm
On Fri, Jul 13, 2018 at 11:07:20PM +0900, Naohiro Aota wrote:
> btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves
> their page address intact. Now, if you hit "goto again" in
> btrfs_extent_same_range() and hit some error in
> btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages.
>
> This is simple fix to reset the address to avoid use-after-free.
>
> Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
> Signed-off-by: Naohiro Aota <naota@elisp.net>
Thanks for catching it.
Reviewed-by: David Sterba <dsterba@suse.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-07-13 15:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-07-13 14:07 [PATCH] btrfs: fix use-after-free of cmp workspace pages Naohiro Aota
2018-07-13 15:30 ` David Sterba
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox