From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wout2-smtp.messagingengine.com ([64.147.123.25]:49975 "EHLO wout2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728183AbeJDWh5 (ORCPT ); Thu, 4 Oct 2018 18:37:57 -0400 Date: Thu, 4 Oct 2018 08:44:02 -0700 From: Greg KH To: Jan Kara Cc: Ted Tso , linux-ext4@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] jbd2: Fix use after free in jbd2_log_do_checkpoint() Message-ID: <20181004154402.GC6921@kroah.com> References: <20181004104640.28326-1-jack@suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20181004104640.28326-1-jack@suse.cz> Sender: stable-owner@vger.kernel.org List-ID: On Thu, Oct 04, 2018 at 12:46:40PM +0200, Jan Kara wrote: > The code cleaning transaction's lists of checkpoint buffers has a bug > where it increases bh refcount only after releasing > journal->j_list_lock. Thus the following race is possible: > > CPU0 CPU1 > jbd2_log_do_checkpoint() > jbd2_journal_try_to_free_buffers() > __journal_try_to_free_buffer(bh) > ... > while (transaction->t_checkpoint_io_list) > ... > if (buffer_locked(bh)) { > > <-- IO completes now, buffer gets unlocked --> > > spin_unlock(&journal->j_list_lock); > spin_lock(&journal->j_list_lock); > __jbd2_journal_remove_checkpoint(jh); > spin_unlock(&journal->j_list_lock); > try_to_free_buffers(page); > get_bh(bh) <-- accesses freed bh > > Fix the problem by grabbing bh reference before unlocking > journal->j_list_lock. > > Fixes: dc6e8d669cf5cb3ff84707c372c0a2a8a5e80845 > Fixes: be1158cc615fd723552f0d9912087423c7cadda5 Nit, this normally looks like: Fixes: dc6e8d669cf5 ("jbd2: don't call get_bh() before calling __jbd2_journal_remove_checkpoint()") And this is created by: git show -s --abbrev-commit --abbrev=12 --pretty=format:"%h (\"%s\")%n" thanks greg k-h