Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 20:22:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

bcachefs: Fix rare use after free in read path

Browse Source 
If the bkey_on_stack_reassemble() call in __bch2_read_indirect_extent()
reallocates the buffer, k in bch2_read - which we pointed at the
bkey_on_stack buffer - will now point to a stale buffer. Whoops.

Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
This commit is contained in:
Kent Overstreet 2020-10-24 20:56:47 -04:00 committed by Kent Overstreet
parent e00711d2ca
commit 13dcd4abcd
3 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/bcachefs/fs-io.c
View File

@ -782,18 +782,19 @@ retry:
if (ret)
break;
bkey_on_stack_reassemble(&sk, c, k);
k = bkey_i_to_s_c(sk.k);
offset_into_extent = iter->pos.offset -
bkey_start_offset(k.k);
sectors = k.k->size - offset_into_extent;
bkey_on_stack_reassemble(&sk, c, k);
ret = bch2_read_indirect_extent(trans,
&offset_into_extent, &sk);
if (ret)
break;
k = bkey_i_to_s_c(sk.k);
sectors = min(sectors, k.k->size - offset_into_extent);
bch2_trans_unlock(trans);

11
fs/bcachefs/fs.c
View File

@ -911,20 +911,21 @@ retry:
continue;
}
bkey_on_stack_realloc(&cur, c, k.k->u64s);
bkey_on_stack_realloc(&prev, c, k.k->u64s);
bkey_reassemble(cur.k, k);
k = bkey_i_to_s_c(cur.k);
offset_into_extent = iter->pos.offset -
bkey_start_offset(k.k);
sectors = k.k->size - offset_into_extent;
bkey_on_stack_realloc(&cur, c, k.k->u64s);
bkey_on_stack_realloc(&prev, c, k.k->u64s);
bkey_reassemble(cur.k, k);
ret = bch2_read_indirect_extent(&trans,
&offset_into_extent, &cur);
if (ret)
break;
k = bkey_i_to_s_c(cur.k);
sectors = min(sectors, k.k->size - offset_into_extent);
if (offset_into_extent)

6
fs/bcachefs/io.c
View File

@ -1667,7 +1667,6 @@ retry:
unsigned bytes, sectors, offset_into_extent;
bkey_on_stack_reassemble(&sk, c, k);
k = bkey_i_to_s_c(sk.k);
offset_into_extent = iter->pos.offset -
bkey_start_offset(k.k);
@ -1678,6 +1677,8 @@ retry:
if (ret)
break;
k = bkey_i_to_s_c(sk.k);
sectors = min(sectors, k.k->size - offset_into_extent);
bch2_trans_unlock(&trans);
@ -2311,13 +2312,14 @@ retry:
sectors = k.k->size - offset_into_extent;
bkey_on_stack_reassemble(&sk, c, k);
k = bkey_i_to_s_c(sk.k);
ret = bch2_read_indirect_extent(&trans,
&offset_into_extent, &sk);
if (ret)
goto err;
k = bkey_i_to_s_c(sk.k);
/*
* With indirect extents, the amount of data to read is the min
* of the original extent and the indirect extent: