diff mbox series

btrfs: fix extent map use-after-free when adding pages to compressed bio

Message ID 21fac1f722255954c5c7e67637e388451ad309c6.1720106056.git.fdmanana@suse.com (mailing list archive)
State New, archived
Headers show
Series btrfs: fix extent map use-after-free when adding pages to compressed bio | expand

Commit Message

Filipe Manana July 4, 2024, 3:16 p.m. UTC 
From: Filipe Manana <fdmanana@suse.com>

Add add_ra_bio_pages() we are accessing the extent map to calculate
'add_size' after we dropped our reference on the extent map, resulting
in a use-after-free. Fix computing 'add_size' before dropping our extent
map reference.

Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/
Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
 fs/btrfs/compression.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

David Sterba July 4, 2024, 5:10 p.m. UTC | #1 
On Thu, Jul 04, 2024 at 04:16:09PM +0100, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> Add add_ra_bio_pages() we are accessing the extent map to calculate
> 'add_size' after we dropped our reference on the extent map, resulting
> in a use-after-free. Fix computing 'add_size' before dropping our extent
> map reference.
> 
> Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/
> Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible")
> Signed-off-by: Filipe Manana <fdmanana@suse.com>

Reviewed-by: David Sterba <dsterba@suse.com>
diff mbox series

Patch

diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 6441e47d8a5e..7c22f5b8c535 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -514,6 +514,7 @@  static noinline int add_ra_bio_pages(struct inode *inode,
 			put_page(page);
 			break;
 		}
+		add_size = min(em->start + em->len, page_end + 1) - cur;
 		free_extent_map(em);
 
 		if (page->index == end_index) {
@@ -526,7 +527,6 @@  static noinline int add_ra_bio_pages(struct inode *inode,
 			}
 		}
 
-		add_size = min(em->start + em->len, page_end + 1) - cur;
 		ret = bio_add_page(orig_bio, page, add_size, offset_in_page(cur));
 		if (ret != add_size) {
 			unlock_extent(tree, cur, page_end, NULL);