lkml.org 
[lkml]   [2022]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] btrfs: don't access possibly stale fs_info data in device_list_add
    On Thu, Mar 03, 2022 at 10:40:27PM +0800, Dongliang Mu wrote:
    > From: Dongliang Mu <mudongliangabcd@gmail.com>
    >
    > Syzbot reported a possible use-after-free in printing information
    > in device_list_add.
    >
    > Very similar with the bug fixed by commit 0697d9a61099 ("btrfs: don't
    > access possibly stale fs_info data for printing duplicate device"),
    > but this time the use occurs in btrfs_info_in_rcu.
    >
    > ============================================================
    > Call Trace:
    > kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
    > btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
    > device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
    > btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
    > btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
    > vfs_ioctl fs/ioctl.c:51 [inline]
    > __do_sys_ioctl fs/ioctl.c:874 [inline]
    > __se_sys_ioctl fs/ioctl.c:860 [inline]
    > __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
    > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    > entry_SYSCALL_64_after_hwframe+0x44/0xae
    > ============================================================
    >
    > Fix this by modifying device->fs_info to NULL too.
    >
    > Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
    > Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>

    Added to misc-next, thanks.

    \
     
     \ /
      Last update: 2022-03-04 15:12    [W:2.778 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site