Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs/btrfs
History
Filipe Manana 3c072fc2c3 btrfs: fix use-after-free when COWing tree bock and tracing is enabled 
[ Upstream commit 44f52bbe96dfdbe4aca3818a2534520082a07040 ]

When a COWing a tree block, at btrfs_cow_block(), and we have the
tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled
(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent
buffer while inside the tracepoint code. This is because in some paths
that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding
the last reference on the extent buffer @buf so btrfs_force_cow_block()
drops the last reference on the @buf extent buffer when it calls
free_extent_buffer_stale(buf), which schedules the release of the extent
buffer with RCU. This means that if we are on a kernel with preemption,
the current task may be preempted before calling trace_btrfs_cow_block()
and the extent buffer already released by the time trace_btrfs_cow_block()
is called, resulting in a use-after-free.

Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to
btrfs_force_cow_block() before the COWed extent buffer is freed.
This also has a side effect of invoking the tracepoint in the tree defrag
code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is
called there, but this is fine and it was actually missing there.

Reported-by: syzbot+8517da8635307182c8a5@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@google.com/
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-01-15 16:29:54 +01:00
..
tests Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
async-thread.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
async-thread.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
backref.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
backref.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block-group.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block-group.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block-rsv.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block-rsv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btrfs_inode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
check-integrity.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
check-integrity.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compression.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compression.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ctree.c btrfs: fix use-after-free when COWing tree bock and tracing is enabled 2025-01-15 16:29:54 +01:00
ctree.h btrfs: rename and export __btrfs_cow_block() 2025-01-15 16:29:54 +01:00
delalloc-space.c btrfs: don't arbitrarily slow down delalloc if we're committing 2024-11-18 11:43:24 +01:00
delalloc-space.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
delayed-inode.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
delayed-inode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
delayed-ref.c btrfs: reinitialize delayed ref list after deleting it from the list 2024-11-30 02:33:25 +01:00
delayed-ref.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dev-replace.c btrfs: dev-replace: properly validate device names 2024-11-18 23:18:29 +01:00
dev-replace.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dir-item.c btrfs: unify lookup return value when dir entry is missing 2024-11-18 22:25:36 +01:00
discard.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
discard.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
disk-io.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
disk-io.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
export.c btrfs: export: handle invalid inode or root reference in btrfs_get_parent() 2024-11-19 09:23:13 +01:00
export.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extent-io-tree.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extent-tree.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
extent_io.c btrfs: switch extent buffer tree lock to rw_semaphore 2025-01-15 16:29:54 +01:00
extent_io.h btrfs: switch extent buffer tree lock to rw_semaphore 2025-01-15 16:29:54 +01:00
extent_map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extent_map.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file-item.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
free-space-cache.c btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() 2024-11-23 23:20:43 +01:00
free-space-cache.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
free-space-tree.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
free-space-tree.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode-item.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode-map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode-map.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
ioctl.c btrfs: fix use-after-free after failure to create a snapshot 2024-11-23 23:21:01 +01:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locking.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
locking.h btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
lzo.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
misc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ordered-data.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ordered-data.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
orphan.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
print-tree.c btrfs: switch extent buffer tree lock to rw_semaphore 2025-01-15 16:29:54 +01:00
print-tree.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
props.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
props.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qgroup.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
qgroup.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
raid56.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
raid56.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rcu-string.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reada.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ref-verify.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
ref-verify.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reflink.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reflink.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
relocation.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
root-tree.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scrub.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
send.c btrfs: send: handle unexpected data in header buffer in begin_cmd() 2024-11-23 23:20:46 +01:00
send.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
space-info.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
space-info.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
struct-funcs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem" 2024-11-18 12:11:47 +01:00
sysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
transaction.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
transaction.h btrfs: fix use-after-free after failure to create a snapshot 2024-11-23 23:21:01 +01:00
tree-checker.c btrfs: tree-checker: reject inline extent items with 0 ref count 2025-01-15 16:29:45 +01:00
tree-checker.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tree-defrag.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
tree-log.c btrfs: locking: remove all the blocking helpers 2025-01-15 16:29:54 +01:00
tree-log.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ulist.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ulist.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uuid-tree.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
volumes.c btrfs: avoid unnecessary device path update for the same device 2024-12-17 13:24:29 +01:00
volumes.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zlib.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zstd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00