[PATCH v5 0/2] btrfs: fix a UAF where btrfs_root::dirty_list is freed but still referred

[Qu Wenruo <wqu@suse.com>]

[CHANGELOG]
v5:
- Drop the first patch
  As we no longer put the list_del_init() call inside
  btrfs_put_root(), the existing code is already safe without the need
  for extra spinlock, as the existing callers are already holding a
  trans handle, thus won't race with transaction cleanup/committing.

- Also drop the spinlock from the 2nd patch
  As we are already safe without that lock.

- Update the commit message of the last commit
  As we no long hold trans_lock for every btrfs_root::dirty_list caller.

v4:
- Also cleanup qgroup swapped blocks and dirty_log_pages
  Which are only released during switch_commit_roots().

v3:
- Use Yalagada's v2 fix as the final UAF fix
  The delayed list_del_init() call inside btrfs_put_root() is not
  safe as another racing ioctl can grab the quota root, extending
  its lifespan.

v2:
- Add extra patches to address Sashiko's comment
  * Make all root->dirty_list users to hold trans_lock
  * Release root->dirty_list from cur_trans->switch_commits during
    transaction cleanup

The first patch is an existing bug exposed by Sashiko, which also
affects the last UAF fix.

The last one is the final UAF fix for the bug reported by syzbot.


Qu Wenruo (1):
  btrfs: prevent use-after-free in btrfs_transaction::switch_commits

Yalagada Pavan Kumar (1):
  btrfs: fix use-after-free on quota enable allocation failure

 fs/btrfs/disk-io.c | 10 ++++++++++
 fs/btrfs/qgroup.c  |  7 +++++++
 2 files changed, 17 insertions(+)

-- 
2.56.0