From: David Sterba <dsterba@suse.cz>
To: Dongliang Mu <dzm91@hust.edu.cn>
Cc: Chris Mason <clm@fb.com>, Josef Bacik <josef@toxicpanda.com>,
David Sterba <dsterba@suse.com>,
Dongliang Mu <mudongliangabcd@gmail.com>,
syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com,
linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
Date: Thu, 3 Mar 2022 19:24:31 +0100 [thread overview]
Message-ID: <20220303182431.GW12643@suse.cz> (raw)
In-Reply-To: <20220303144027.1981835-1-dzm91@hust.edu.cn>
On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
> From: Dongliang Mu <mudongliangabcd@gmail.com>
>
> Syzbot reported a possible use-after-free in printing information
> in device_list_add.
>
> Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
> access possibly stale fs_info data for printing duplicate device"),
> but this time the use occurs in btrfs_info_in_rcu.
>
> ============================================================
> Call Trace:
> kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
> btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
> device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
> btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
> btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> ============================================================
>
> Fix this by modifying device->fs_info to NULL too.
>
> Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> ---
> fs/btrfs/volumes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index b07d382d53a8..c1325bdae9a1 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -954,7 +954,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> task_pid_nr(current));
> return ERR_PTR(-EEXIST);
> }
> - btrfs_info_in_rcu(device->fs_info,
> + btrfs_info_in_rcu(NULL,
A few lines above this is also NULL and was fixed by 0697d9a61099
("btrfs: don't access possibly stale fs_info data for printing duplicate
device"), so yeah we probably need the same here.
next prev parent reply other threads:[~2022-03-03 18:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-03 14:40 [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add Dongliang Mu
2022-03-03 18:24 ` David Sterba [this message]
2022-03-03 23:53 ` Anand Jain
2022-03-04 13:50 ` David Sterba
2022-03-04 14:07 ` David Sterba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220303182431.GW12643@suse.cz \
--to=dsterba@suse.cz \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=dzm91@hust.edu.cn \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mudongliangabcd@gmail.com \
--cc=syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).