btrfs: fix use after free iterating extrefs
PATCH 1/1 btrfs: fix use after free iterating extrefs
The code for btrfs inode-resolve has never worked properly for files with enough hard links to trigger extrefs. It was trying to get the leaf out of a path after freeing the path:
btrfs_release_path(path); leaf = path->nodes[0]; item_size = btrfs_item_size_nr(leaf, slot);
The fix here is to use the extent buffer we cloned just a little higher up to avoid deadlocks caused by using the leaf in the path.
--- fs/btrfs/backref.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
fs/btrfs/backref.c +3 -5
@@ -1828,7 +1828,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,int found =0 ;struct extent_buffer *eb;struct btrfs_inode_extref *extref; -struct extent_buffer *leaf;u32 item_size;u32 cur_offset;unsigned long ptr;
@@ -1856,9 +1855,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,btrfs_set_lock_blocking_rw (eb,BTRFS_READ_LOCK );btrfs_release_path (path); - leaf = path->nodes[0 ]; - item_size =btrfs_item_size_nr (leaf, slot); - ptr =btrfs_item_ptr_offset (leaf, slot); + item_size =btrfs_item_size_nr (eb, slot); + ptr =btrfs_item_ptr_offset (eb, slot); cur_offset =0 ;while (cur_offset < item_size) {
@@ -1872,7 +1870,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,if (ret)break ; - cur_offset +=btrfs_inode_extref_name_len (leaf, extref); + cur_offset +=btrfs_inode_extref_name_len (eb, extref); cur_offset +=sizeof (*extref); }btrfs_tree_read_unlock_blocking (eb);
Signature · 1 line
2.4.6
Quoted 8 lines · Chris Mason
The code for btrfs inode-resolve has never worked properly for files with enough hard links to trigger extrefs. It was trying to get the leaf out of a path after freeing the path:
btrfs_release_path(path); leaf = path->nodes[0]; item_size = btrfs_item_size_nr(leaf, slot);
Quoted 6 lines
The fix here is to use the extent buffer we cloned just a little higher up to avoid deadlocks caused by using the leaf in the path.
Signed-off-by Chris Mason <[email protected]>cc [email protected] # v3.7+cc Mark Fasheh <[email protected]>
Looks good to me.
I failed to notice that problem at commit [1]
Quoted 44 lines
--- fs/btrfs/backref.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)fs/btrfs/backref.c +3
-6@@ -1828,7 +1828,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,int found =0 ;struct extent_buffer *eb;struct btrfs_inode_extref *extref; -struct extent_buffer *leaf;u32 item_size;u32 cur_offset;unsigned long ptr;@@ -1856,9 +1855,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,btrfs_set_lock_blocking_rw (eb,BTRFS_READ_LOCK );btrfs_release_path (path); - leaf = path->nodes[0 ]; - item_size =btrfs_item_size_nr (leaf, slot); - ptr =btrfs_item_ptr_offset (leaf, slot); + item_size =btrfs_item_size_nr (eb, slot); + ptr =btrfs_item_ptr_offset (eb, slot); cur_offset =0 ;while (cur_offset < item_size) {@@ -1872,7 +1870,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,if (ret)break ; - cur_offset +=btrfs_inode_extref_name_len (leaf, extref); + cur_offset +=btrfs_inode_extref_name_len (eb, extref); cur_offset +=sizeof (*extref); }btrfs_tree_read_unlock_blocking (eb); --2.4.6
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 5 lines
Filipe David Manana, "Reasonable men adapt themselves to the world. Unreasonable men adapt the world to themselves. That's why all progress depends on unreasonable men."
Quoted 8 lines · Chris Mason
The code for btrfs inode-resolve has never worked properly for files with enough hard links to trigger extrefs. It was trying to get the leaf out of a path after freeing the path:
btrfs_release_path(path); leaf = path->nodes[0]; item_size = btrfs_item_size_nr(leaf, slot);
Quoted 6 lines
The fix here is to use the extent buffer we cloned just a little higher up to avoid deadlocks caused by using the leaf in the path.
Signed-off-by Chris Mason <[email protected]>cc [email protected] # v3.7+cc Mark Fasheh <[email protected]>
Thanks for the CC Chris.
--Mark
--
Mark Fasheh
Quoted 9 lines · Mark Fasheh
Quoted 8 lines · Chris Mason
The code for btrfs inode-resolve has never worked properly for files with enough hard links to trigger extrefs. It was trying to get the leaf out of a path after freeing the path:
btrfs_release_path(path); leaf = path->nodes[0]; item_size = btrfs_item_size_nr(leaf, slot);
Quoted 7 lines
Quoted 6 lines
The fix here is to use the extent buffer we cloned just a little higher up to avoid deadlocks caused by using the leaf in the path.
Signed-off-by Chris Mason <[email protected]>cc [email protected] # v3.7+cc Mark Fasheh <[email protected]>Reviewed-by Mark Fasheh <[email protected]>
Thanks Mark and Filipe, I've tested this and queued it up.
-chris