* [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
@ 2022-03-03 14:40 Dongliang Mu
2022-03-03 18:24 ` David Sterba
2022-03-04 14:07 ` David Sterba
0 siblings, 2 replies; 5+ messages in thread
From: Dongliang Mu @ 2022-03-03 14:40 UTC (permalink / raw)
To: Chris Mason, Josef Bacik, David Sterba
Cc: Dongliang Mu, syzbot+82650a4e0ed38f218363, linux-btrfs, linux-kernel
From: Dongliang Mu <mudongliangabcd@gmail.com>
Syzbot reported a possible use-after-free in printing information
in device_list_add.
Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
access possibly stale fs_info data for printing duplicate device"),
but this time the use occurs in btrfs_info_in_rcu.
============================================================
Call Trace:
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
============================================================
Fix this by modifying device->fs_info to NULL too.
Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
fs/btrfs/volumes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b07d382d53a8..c1325bdae9a1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -954,7 +954,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
task_pid_nr(current));
return ERR_PTR(-EEXIST);
}
- btrfs_info_in_rcu(device->fs_info,
+ btrfs_info_in_rcu(NULL,
"devid %llu device path %s changed to %s scanned by %s (%d)",
devid, rcu_str_deref(device->name),
path, current->comm,
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
2022-03-03 14:40 [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add Dongliang Mu
@ 2022-03-03 18:24 ` David Sterba
2022-03-03 23:53 ` Anand Jain
2022-03-04 14:07 ` David Sterba
1 sibling, 1 reply; 5+ messages in thread
From: David Sterba @ 2022-03-03 18:24 UTC (permalink / raw)
To: Dongliang Mu
Cc: Chris Mason, Josef Bacik, David Sterba, Dongliang Mu,
syzbot+82650a4e0ed38f218363, linux-btrfs, linux-kernel
On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
> From: Dongliang Mu <mudongliangabcd@gmail.com>
>
> Syzbot reported a possible use-after-free in printing information
> in device_list_add.
>
> Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
> access possibly stale fs_info data for printing duplicate device"),
> but this time the use occurs in btrfs_info_in_rcu.
>
> ============================================================
> Call Trace:
> kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
> btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
> device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
> btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
> btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> ============================================================
>
> Fix this by modifying device->fs_info to NULL too.
>
> Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> ---
> fs/btrfs/volumes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index b07d382d53a8..c1325bdae9a1 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -954,7 +954,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> task_pid_nr(current));
> return ERR_PTR(-EEXIST);
> }
> - btrfs_info_in_rcu(device->fs_info,
> + btrfs_info_in_rcu(NULL,
A few lines above this is also NULL and was fixed by 0697d9a61099
("btrfs: don't access possibly stale fs_info data for printing duplicate
device"), so yeah we probably need the same here.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
2022-03-03 18:24 ` David Sterba
@ 2022-03-03 23:53 ` Anand Jain
2022-03-04 13:50 ` David Sterba
0 siblings, 1 reply; 5+ messages in thread
From: Anand Jain @ 2022-03-03 23:53 UTC (permalink / raw)
To: Dongliang Mu, Dongliang Mu
Cc: linux-btrfs, linux-kernel, Chris Mason,
syzbot+82650a4e0ed38f218363, Josef Bacik, dsterba, David Sterba
On 04/03/2022 02:24, David Sterba wrote:
> On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
>> From: Dongliang Mu <mudongliangabcd@gmail.com>
>>
>> Syzbot reported a possible use-after-free in printing information
>> in device_list_add.
>>
>> Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
>> access possibly stale fs_info data for printing duplicate device"),
>> but this time the use occurs in btrfs_info_in_rcu.
>>
>> ============================================================
>> Call Trace:
>> kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
>> btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
>> device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
>> btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
>> btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
>> vfs_ioctl fs/ioctl.c:51 [inline]
>> __do_sys_ioctl fs/ioctl.c:874 [inline]
>> __se_sys_ioctl fs/ioctl.c:860 [inline]
>> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
>> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> ============================================================
>>
>> Fix this by modifying device->fs_info to NULL too.
>>
>> Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
>> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
>> ---
>> fs/btrfs/volumes.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
>> index b07d382d53a8..c1325bdae9a1 100644
>> --- a/fs/btrfs/volumes.c
>> +++ b/fs/btrfs/volumes.c
>> @@ -954,7 +954,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
>> task_pid_nr(current));
>> return ERR_PTR(-EEXIST);
>> }
>> - btrfs_info_in_rcu(device->fs_info,
>> + btrfs_info_in_rcu(NULL,
>
> A few lines above this is also NULL and was fixed by 0697d9a61099
> ("btrfs: don't access possibly stale fs_info data for printing duplicate
> device"), so yeah we probably need the same here.
So it appears that device->fs_info was garbage instead of NULL OR
fs_info->sb was NULL?
Because we always had a check if fs_info is null in btrfs_printk()
further the commit a0f6d924cada ("btrfs: remove stub device info from
messages when we have no fs_info") made it better.
Thanks, Anand
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
2022-03-03 23:53 ` Anand Jain
@ 2022-03-04 13:50 ` David Sterba
0 siblings, 0 replies; 5+ messages in thread
From: David Sterba @ 2022-03-04 13:50 UTC (permalink / raw)
To: Anand Jain
Cc: Dongliang Mu, Dongliang Mu, linux-btrfs, linux-kernel,
Chris Mason, syzbot+82650a4e0ed38f218363, Josef Bacik, dsterba,
David Sterba
On Fri, Mar 04, 2022 at 07:53:27AM +0800, Anand Jain wrote:
> On 04/03/2022 02:24, David Sterba wrote:
> > On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
> >>
> >> Fix this by modifying device->fs_info to NULL too.
> >>
> >> Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> >> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> >> ---
> >> fs/btrfs/volumes.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> >> index b07d382d53a8..c1325bdae9a1 100644
> >> --- a/fs/btrfs/volumes.c
> >> +++ b/fs/btrfs/volumes.c
> >> @@ -954,7 +954,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> >> task_pid_nr(current));
> >> return ERR_PTR(-EEXIST);
> >> }
> >> - btrfs_info_in_rcu(device->fs_info,
> >> + btrfs_info_in_rcu(NULL,
> >
> > A few lines above this is also NULL and was fixed by 0697d9a61099
> > ("btrfs: don't access possibly stale fs_info data for printing duplicate
> > device"), so yeah we probably need the same here.
>
> So it appears that device->fs_info was garbage instead of NULL OR
> fs_info->sb was NULL?
I think it's a warning that something could happen, in this case
potential garbage value of fs_info.
> Because we always had a check if fs_info is null in btrfs_printk()
> further the commit a0f6d924cada ("btrfs: remove stub device info from
> messages when we have no fs_info") made it better.
Yeah, that's removing a potential crash but still the NULL value could
come from a freed memory. Seems taht we can't rely on fs_info in
device_list_add at all and passing NULL is the only safe way.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
2022-03-03 14:40 [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add Dongliang Mu
2022-03-03 18:24 ` David Sterba
@ 2022-03-04 14:07 ` David Sterba
1 sibling, 0 replies; 5+ messages in thread
From: David Sterba @ 2022-03-04 14:07 UTC (permalink / raw)
To: Dongliang Mu
Cc: Chris Mason, Josef Bacik, David Sterba, Dongliang Mu,
syzbot+82650a4e0ed38f218363, linux-btrfs, linux-kernel
On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
> From: Dongliang Mu <mudongliangabcd@gmail.com>
>
> Syzbot reported a possible use-after-free in printing information
> in device_list_add.
>
> Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
> access possibly stale fs_info data for printing duplicate device"),
> but this time the use occurs in btrfs_info_in_rcu.
>
> ============================================================
> Call Trace:
> kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
> btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
> device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
> btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
> btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> ============================================================
>
> Fix this by modifying device->fs_info to NULL too.
>
> Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Added to misc-next, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-03-04 14:11 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-03 14:40 [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add Dongliang Mu
2022-03-03 18:24 ` David Sterba
2022-03-03 23:53 ` Anand Jain
2022-03-04 13:50 ` David Sterba
2022-03-04 14:07 ` David Sterba
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).