From: Josef Bacik <josef@toxicpanda.com>
To: Qu Wenruo <wqu@suse.com>, linux-btrfs@vger.kernel.org
Cc: Marcos Paulo de Souza <mpdesouza@suse.de>
Subject: Re: [PATCH] btrfs: Don't free tree_root when exiting btrfs_ioctl_get_subvol_info()
Date: Thu, 13 Feb 2020 15:20:44 -0500 [thread overview]
Message-ID: <2bca9e56-f5ce-6bf7-9e6f-8897f5c03d22@toxicpanda.com> (raw)
In-Reply-To: <20200213130157.39230-1-wqu@suse.com>
On 2/13/20 8:01 AM, Qu Wenruo wrote:
> [BUG]
> When calling BTRF_IOC_GET_SUBVOL_INFO ioctl, we can easily hit the
> following backtrace:
> BUG: kernel NULL pointer dereference, address: 0000000000000024
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP PTI
> CPU: 0 PID: 27421 Comm: python3 Not tainted 5.6.0-rc1+ #539
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
> RIP: 0010:btrfs_root_node+0x7/0x30 [btrfs]
> Call Trace:
> btrfs_read_lock_root_node+0x1f/0x40 [btrfs]
> btrfs_search_slot+0x60f/0xa40 [btrfs]
> btrfs_ioctl+0x11f7/0x30b0 [btrfs]
> ksys_ioctl+0x82/0xc0
> __x64_sys_ioctl+0x11/0x20
> do_syscall_64+0x43/0x130
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7fcb78d43387
> ---[ end trace 1c21a7c6c0523b8c ]---
>
> [CAUSE]
> We're abusing local @root, it's originally a subvolume root, but in
> root backref search, it's re-assigned to tree_root.
>
> Then we call "btrfs_put_root(root);" when exiting.
> If that @root is reassgined to tree-root, we freed the most important
> tree, and cause use-after-free.
>
> [FIX]
> Don't re-assgiend @root, use fs_info->tree_root directly.
>
> Reported-by: Marcos Paulo de Souza <mpdesouza@suse.de>
> Fixes: 8c319b625e0a ("btrfs: hold a ref on the root in btrfs_ioctl_get_subvol_info")
> [To David: please fold the fix into that commit]
> Signed-off-by: Qu Wenruo <wqu@suse.com>
Ooops
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Thanks,
Josef
next prev parent reply other threads:[~2020-02-13 20:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-13 13:01 [PATCH] btrfs: Don't free tree_root when exiting btrfs_ioctl_get_subvol_info() Qu Wenruo
2020-02-13 17:43 ` Marcos Paulo de Souza
2020-02-13 20:20 ` Josef Bacik [this message]
2020-02-14 13:38 ` David Sterba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2bca9e56-f5ce-6bf7-9e6f-8897f5c03d22@toxicpanda.com \
--to=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=mpdesouza@suse.de \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).