Re: [PATCH][v3] btrfs: only search for left_info if there is no right_info

[David Sterba <dsterba@suse.cz>]

On Mon, Jul 27, 2020 at 10:28:05AM -0400, Josef Bacik wrote:
> In try_to_merge_free_space we attempt to find entries to the left and
> right of the entry we are adding to see if they can be merged.  We
> search for an entry past our current info (saved into right_info), and
> then if right_info exists and it has a rb_prev() we save the rb_prev()
> into left_info.
> 
> However there's a slight problem in the case that we have a right_info,
> but no entry previous to that entry.  At that point we will search for
> an entry just before the info we're attempting to insert.  This will
> simply find right_info again, and assign it to left_info, making them
> both the same pointer.
> 
> Now if right_info _can_ be merged with the range we're inserting, we'll
> add it to the info and free right_info.  However further down we'll
> access left_info, which was right_info, and thus get a UAF.
> 
> Fix this by only searching for the left entry if we don't find a right
> entry at all.
> 
> The CVE referenced had a specially crafted file system that could
> trigger this UAF.  However with the tree checker improvements we no
> longer trigger the conditions for the UAF.  But the original conditions
> still apply, hence this fix.
> 
> Reference: CVE-2019-19448
> Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> ---
> v2->v3:
> - Updated the changelog.

Added to misc-next, thanks.