Re: [PATCH][v2] btrfs: only search for left_info if there is no right_info

[David Sterba <dsterba@suse.cz>]

On Wed, Jul 22, 2020 at 02:45:37PM -0400, Josef Bacik wrote:
> The CVE referenced doesn't actually trigger the problem anymore because
> of the tree-checker improvements, however the underlying issue can still
> happen.

What was the problem?

> If we find a right_info, but rb_prev() is NULL, then we're the furthest
> most item in the tree currently, and there will be no left_info.
> However we'll still search from offset-1, which would return right_info
> again which we store in left_info.  If we then free right_info we'll
> have free'd left_info as well, and boom, UAF.  Instead fix this check so
> that if we don't have a right_info we do the search for the left_info,
> otherwise left_info comes from rb_prev or is simply NULL as it should
> be.
> 
> Reference: CVE-2019-19448
> Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> ---
> v1->v2:
> - Fixed the title, I had changed the fix but forgot to change the title in v1

The title still repeats what the code does and left_info or right_info
are not terms that are understood without context (unlike eg. fs_info)