| Message ID | 20210414134737.2366971-6-yi.zhang@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | ext4, jbd2: fix 3 issues about bdev_try_to_free_page() | expand |
On Wed, Apr 14, 2021 at 09:47:35PM +0800, Zhang Yi wrote: > In blkdev_releasepage() we access the superblock structure directly, it > could be raced by umount filesystem on destroy superblock in put_super(), > and end up triggering a use after free issue. The subject is wrong, this does not change ext4 code.
diff --git a/fs/block_dev.c b/fs/block_dev.c index 5ed79a9063f6..cb84f347fb04 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1734,11 +1734,14 @@ EXPORT_SYMBOL_GPL(blkdev_read_iter); */ static int blkdev_releasepage(struct page *page, gfp_t wait) { - struct super_block *super = BDEV_I(page->mapping->host)->bdev.bd_super; + struct super_block *super; int ret = 0; + rcu_read_lock(); + super = READ_ONCE(BDEV_I(page->mapping->host)->bdev.bd_super); if (super && super->s_op->bdev_try_to_free_page) ret = super->s_op->bdev_try_to_free_page(super, page, wait); + rcu_read_unlock(); if (!ret) return try_to_free_buffers(page); return 0;
In blkdev_releasepage() we access the superblock structure directly, it could be raced by umount filesystem on destroy superblock in put_super(), and end up triggering a use after free issue. drop cache umount filesystem bdev_try_to_free_page() get superblock deactivate_locked_super() ... put_super() and free sb by destroy_work access superblock <-- trigger use after free This issue doesn't trigger easily in general because we get page locked when invoking bdev_try_to_free_page(), and when umount filesystem the kill_block_super()->..->kill_bdev()->truncate_inode_pages_range() procedure wait on page unlock, but it's not a guarantee. Fix this race by use RCU to protect superblock in blkdev_releasepage(). Fixes: 87d8fe1ee6b8 ("add releasepage hooks to block devices which can be used by file systems") Reported-by: Jan Kara <jack@suse.cz> Signed-off-by: Zhang Yi <yi.zhang@huawei.com> --- fs/block_dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)