Josef Bacik bf53d4687b btrfs: only search for left_info if there is no right_info in try_merge_free_space ... In try_to_merge_free_space we attempt to find entries to the left and right of the entry we are adding to see if they can be merged. We search for an entry past our current info (saved into right_info), and then if right_info exists and it has a rb_prev() we save the rb_prev() into left_info. However there's a slight problem in the case that we have a right_info, but no entry previous to that entry. At that point we will search for an entry just before the info we're attempting to insert. This will simply find right_info again, and assign it to left_info, making them both the same pointer. Now if right_info _can_ be merged with the range we're inserting, we'll add it to the info and free right_info. However further down we'll access left_info, which was right_info, and thus get a use-after-free. Fix this by only searching for the left entry if we don't find a right entry at all. The CVE referenced had a specially crafted file system that could trigger this use-after-free. However with the tree checker improvements we no longer trigger the conditions for the UAF. But the original conditions still apply, hence this fix. Reference: CVE-2019-19448 Fixes: 9630308170 ("Btrfs: use hybrid extents+bitmap rb tree for free space") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: David Sterba <dsterba@suse.com>		2020-08-10 18:58:07 +02:00
..
tests	btrfs: make btrfs_set_extent_delalloc take btrfs_inode	2020-07-27 12:55:35 +02:00
acl.c	btrfs: cleanup btrfs_setxattr_trans and drop transaction parameter	2019-04-29 19:02:44 +02:00
async-thread.c	Btrfs: fix crash during unmount due to race with delayed inode workers	2020-03-23 17:01:51 +01:00
async-thread.h	Btrfs: fix crash during unmount due to race with delayed inode workers	2020-03-23 17:01:51 +01:00
backref.c	btrfs: fix double free on ulist after backref resolution failure	2020-07-21 21:59:15 +02:00
backref.h	btrfs: rename BTRFS_ROOT_REF_COWS to BTRFS_ROOT_SHAREABLE	2020-05-25 11:25:35 +02:00
block-group.c	btrfs: if we're restriping, use the target restripe profile	2020-07-27 12:55:47 +02:00
block-group.h	btrfs: convert block group refcount to refcount_t	2020-07-27 12:55:42 +02:00
block-rsv.c	btrfs: rename BTRFS_ROOT_REF_COWS to BTRFS_ROOT_SHAREABLE	2020-05-25 11:25:35 +02:00
block-rsv.h	btrfs: Remove __ prefix from btrfs_block_rsv_release	2020-03-23 17:01:55 +01:00
btrfs_inode.h	btrfs: reduce contention on log trees when logging checksums	2020-07-27 12:55:45 +02:00
check-integrity.c	btrfs: check-integrity: remove unnecessary failure messages during memory allocation	2020-07-27 12:55:21 +02:00
check-integrity.h	btrfs: remove btrfsic_submit_bh()	2020-03-23 17:01:39 +01:00
compression.c	btrfs: remove fail label in check_compressed_csum	2020-07-27 12:55:42 +02:00
compression.h	btrfs: make btrfs_submit_compressed_write take btrfs_inode	2020-07-27 12:55:31 +02:00
ctree.c	btrfs: add little-endian optimized key helpers	2020-07-27 12:55:24 +02:00
ctree.h	btrfs: don't WARN if we abort a transaction with EROFS	2020-07-27 12:55:46 +02:00
delalloc-space.c	btrfs: make btrfs_delalloc_reserve_space take btrfs_inode	2020-07-27 12:55:36 +02:00
delalloc-space.h	btrfs: make btrfs_delalloc_reserve_space take btrfs_inode	2020-07-27 12:55:36 +02:00
delayed-inode.c	btrfs: use nofs allocations for running delayed items	2020-03-25 16:26:00 +01:00
delayed-inode.h	btrfs: delayed-inode: Replace zero-length array with flexible-array member	2020-03-23 17:01:53 +01:00
delayed-ref.c	btrfs: Remove __ prefix from btrfs_block_rsv_release	2020-03-23 17:01:55 +01:00
delayed-ref.h	btrfs: migrate the delayed refs rsv code	2019-07-04 17:26:17 +02:00
dev-replace.c	btrfs: sysfs, rename device_link add/remove functions	2020-03-23 17:01:35 +01:00
dev-replace.h	btrfs: add __pure attribute to functions	2019-11-18 12:46:52 +01:00
dir-item.c	btrfs: remove unused parameter fs_info from btrfs_extend_item	2019-04-29 19:02:50 +02:00
discard.c	btrfs: discard: add missing put when grabbing block group from unused list	2020-07-07 16:06:28 +02:00
discard.h	btrfs: discard: Use the correct style for SPDX License Identifier	2020-04-20 17:43:42 +02:00
disk-io.c	btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT	2020-07-27 12:55:43 +02:00
disk-io.h	btrfs: preallocate anon block device at first phase of snapshot creation	2020-07-27 12:55:38 +02:00
export.c	btrfs: simplify iget helpers	2020-05-25 11:25:37 +02:00
export.h	btrfs: export helpers for subvolume name/id resolution	2020-03-23 17:01:42 +01:00
extent_io.c	btrfs: do not set the full sync flag on the inode during page release	2020-07-27 12:55:48 +02:00
extent_io.h	btrfs: don't use UAPI types for fiemap callback	2020-07-27 12:55:27 +02:00
extent_map.c	Btrfs: fix race between using extent maps and merging them	2020-02-12 17:16:46 +01:00
extent_map.h	btrfs: remove extent_map::bdev	2019-11-18 23:43:44 +01:00
extent-io-tree.h	btrfs: streamline btrfs_get_io_failure_record logic	2020-07-27 12:55:39 +02:00
extent-tree.c	btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree	2020-07-27 12:55:45 +02:00
file-item.c	btrfs: make btrfs_csum_one_bio takae btrfs_inode	2020-07-27 12:55:26 +02:00
file.c	btrfs: make btrfs_check_data_free_space take btrfs_inode	2020-07-27 12:55:36 +02:00
free-space-cache.c	btrfs: only search for left_info if there is no right_info in try_merge_free_space	2020-08-10 18:58:07 +02:00
free-space-cache.h	btrfs: let btrfs_return_cluster_to_free_space() return void	2020-07-27 12:55:21 +02:00
free-space-tree.c	btrfs: move the root freeing stuff into btrfs_put_root	2020-03-23 17:01:59 +01:00
free-space-tree.h	btrfs: rename btrfs_block_group_cache	2019-11-18 17:51:51 +01:00
inode-item.c	btrfs: Make btrfs_find_name_in_ext_backref return struct btrfs_inode_extref	2019-09-09 14:59:16 +02:00
inode-map.c	btrfs: make btrfs_delalloc_reserve_space take btrfs_inode	2020-07-27 12:55:36 +02:00
inode-map.h
inode.c	btrfs: inode: fix NULL pointer dereference if inode doesn't need compression	2020-08-10 18:57:59 +02:00
ioctl.c	btrfs: add missing check for nocow and compression inode flags	2020-07-27 12:55:44 +02:00
Kconfig	Revert "btrfs: switch to iomap_dio_rw() for dio"	2020-06-14 01:19:02 +02:00
locking.c	btrfs: add missing annotation for btrfs_tree_lock()	2020-05-25 11:25:16 +02:00
locking.h	btrfs: Implement DREW lock	2020-03-23 17:01:43 +01:00
lzo.c	btrfs: compression: inline free_workspace	2019-11-18 12:46:59 +01:00
Makefile	Btrfs: move all reflink implementation code into its own file	2020-03-23 17:01:54 +01:00
misc.h	btrfs: rename tree_entry to rb_simple_node and export it	2020-05-25 11:25:19 +02:00
ordered-data.c	btrfs: make btrfs_add_ordered_extent_dio take btrfs_inode	2020-07-27 12:55:34 +02:00
ordered-data.h	btrfs: make btrfs_add_ordered_extent_dio take btrfs_inode	2020-07-27 12:55:34 +02:00
orphan.c
print-tree.c	btrfs: Remove unneeded semicolon	2020-01-20 16:40:55 +01:00
print-tree.h
props.c	btrfs: simplify iget helpers	2020-05-25 11:25:37 +02:00
props.h	btrfs: delete unused function btrfs_set_prop_trans	2019-04-29 19:02:54 +02:00
qgroup.c	btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT	2020-07-27 12:55:43 +02:00
qgroup.h	btrfs: qgroup: export qgroups in sysfs	2020-07-27 12:55:37 +02:00
raid56.c	btrfs: raid56: remove out label in __raid56_parity_recover	2020-07-27 12:55:44 +02:00
raid56.h	btrfs: constify map parameter for nr_parity_stripes and nr_data_stripes	2019-07-01 13:34:58 +02:00
rcu-string.h	btrfs: rcu-string: Replace zero-length array with flexible-array member	2020-03-23 17:01:53 +01:00
reada.c	btrfs: rename btrfs_block_group_cache	2019-11-18 17:51:51 +01:00
ref-verify.c	btrfs: ref-verify: fix memory leak in add_block_entry	2020-07-27 12:55:43 +02:00
ref-verify.h	btrfs: ref-verify: Use btrfs_ref to refactor btrfs_ref_tree_mod()	2019-04-29 19:02:49 +02:00
reflink.c	btrfs: reduce contention on log trees when logging checksums	2020-07-27 12:55:45 +02:00
reflink.h	Btrfs: move all reflink implementation code into its own file	2020-03-23 17:01:54 +01:00
relocation.c	btrfs: relocation: review the call sites which can be interrupted by signal	2020-07-27 12:55:45 +02:00
root-tree.c	btrfs: simplify root lookup by id	2020-05-25 11:25:36 +02:00
scrub.c	btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases	2020-07-27 12:55:46 +02:00
send.c	for-5.8-tag	2020-06-02 19:59:25 -07:00
send.h
space-info.c	btrfs: fix lockdep splat from btrfs_dump_space_info	2020-07-27 12:55:47 +02:00
space-info.h	btrfs: improve global reserve stealing logic	2020-05-25 11:25:22 +02:00
struct-funcs.c	btrfs: update documentation of set/get helpers	2020-05-25 11:25:35 +02:00
super.c	btrfs: open-code remount flag setting in btrfs_remount	2020-07-27 12:55:47 +02:00
sysfs.c	btrfs: sysfs: use NOFS for device creation	2020-07-27 12:55:46 +02:00
sysfs.h	btrfs: qgroup: export qgroups in sysfs	2020-07-27 12:55:37 +02:00
transaction.c	btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases	2020-07-27 12:55:46 +02:00
transaction.h	btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT	2020-07-27 12:55:43 +02:00
tree-checker.c	btrfs: tree-checker: remove duplicate definition of 'inode_item_err'	2020-05-25 11:25:23 +02:00
tree-checker.h	btrfs: get fs_info from eb in btrfs_check_chunk_valid	2019-04-29 19:02:39 +02:00
tree-defrag.c	btrfs: remove unused btrfs_root::defrag_trans_start	2020-07-27 12:55:28 +02:00
tree-log.c	btrfs: reduce contention on log trees when logging checksums	2020-07-27 12:55:45 +02:00
tree-log.h	btrfs: get fs_info from trans in btrfs_set_log_full_commit	2019-04-29 19:02:41 +02:00
ulist.c
ulist.h
uuid-tree.c	btrfs: simplify root lookup by id	2020-05-25 11:25:36 +02:00
volumes.c	btrfs: move the chunk_mutex in btrfs_read_chunk_tree	2020-07-27 12:55:46 +02:00
volumes.h	btrfs: record btrfs_device directly in btrfs_io_bio	2020-07-27 12:55:40 +02:00
xattr.c	Btrfs: fix failure to persist compression property xattr deletion on fsync	2019-06-17 16:37:17 +02:00
xattr.h	btrfs: cleanup btrfs_setxattr_trans and drop transaction parameter	2019-04-29 19:02:44 +02:00
zlib.c	btrfs: use larger zlib buffer for s390 hardware compression	2020-01-31 10:30:40 -08:00
zstd.c	btrfs: compression: inline free_workspace	2019-11-18 12:46:59 +01:00