Received: by 10.213.65.68 with SMTP id h4csp1724782imn; Mon, 19 Mar 2018 11:30:27 -0700 (PDT) X-Google-Smtp-Source: AG47ELuNikCrRZ7sd7drTA006EleB6TKBVk4BvdYHpK8gHHXQDn/+3u2oMT7ScshhVyLw1KdALhE X-Received: by 10.99.105.7 with SMTP id e7mr9745513pgc.193.1521484227133; Mon, 19 Mar 2018 11:30:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521484227; cv=none; d=google.com; s=arc-20160816; b=Oh+uk7EfQKieqa/CuT6EjPi2oLb/GdCn5fx00BDEyQBdabilcMG5JtxoWL0Y+/93Fs Eynh2E/6h/hRicQEzY4o6+8Oh9ozSGjfp1B43bEnseJNVDIOaxpSB3VeTDpaRUGgFKEK KRggjWhWTMfseqhGc5hRHRdQJ1mL2H/+UOZmzgnNu6ogRyml2VqTqZRVJj4rraLLMoLp IkDXBVnuhqQhYoddEeIsX4MD+qcZYui37Jh1Pz2iJFhkGpzGZyeObZbYOkdXBWWKEWgT tamWIqdXWYxrr2zZZ1MTLP65w0luXWMewUT6phhSfbW9Ng2tL2W5+ouCB+EGBpYJ/OPj LVMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=ZqYLx8YAAi0N5jFuOaXWmZ0bSGbNAq/ac5a6UXzAEdU=; b=JXF5ZUOkr0WSnf5DzmAFRX1j3KFOBz3det/C7PPtxOBclPbYIrMzhdWBNgmrhwzPq3 m1DoZ1OcaKNssGrn02nN3Ze095p73nFkhyK4rx6xfZZyLLPUI7Gu4+FjolJFUndvmy40 NQArat1upd63/99xP/ODVHyaXYXpLbE8PlUDrdJcENC9sOaE4o0d6Hs6uNnikiRn1cVJ 0Z2LizDBDjYmFLghHn43gzfSgE4JVQ87GZ38dO6tCT1ZpmZRzcMw6UJyVWX+x0jXiFZG Jhqtok1qEXJlMRyKXcprMMJY0XOOPpX/X2qlKTfxo7b0sy8gxkRpc112XmuDPzricHty PFaA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f125si277151pgc.736.2018.03.19.11.30.12; Mon, 19 Mar 2018 11:30:27 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1031763AbeCSS2l (ORCPT + 99 others); Mon, 19 Mar 2018 14:28:41 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:52294 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1031748AbeCSS2g (ORCPT ); Mon, 19 Mar 2018 14:28:36 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 0165FF3E; Mon, 19 Mar 2018 18:28:34 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikolay Borisov , Anand Jain , David Sterba Subject: [PATCH 4.9 237/241] btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device Date: Mon, 19 Mar 2018 19:08:22 +0100 Message-Id: <20180319180800.989583878@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180319180751.172155436@linuxfoundation.org> References: <20180319180751.172155436@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nikolay Borisov commit fd649f10c3d21ee9d7542c609f29978bdf73ab94 upstream. Commit 4fde46f0cc71 ("Btrfs: free the stale device") introduced btrfs_free_stale_device which iterates the device lists for all registered btrfs filesystems and deletes those devices which aren't mounted. In a btrfs_devices structure has only 1 device attached to it and it is unused then btrfs_free_stale_devices will proceed to also free the btrfs_fs_devices struct itself. Currently this leads to a use after free since list_for_each_entry will try to perform a check on the already freed memory to see if it has to terminate the loop. The fix is to use 'break' when we know we are freeing the current fs_devs. Fixes: 4fde46f0cc71 ("Btrfs: free the stale device") Signed-off-by: Nikolay Borisov Reviewed-by: Anand Jain Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/volumes.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -583,6 +583,7 @@ void btrfs_free_stale_device(struct btrf btrfs_sysfs_remove_fsid(fs_devs); list_del(&fs_devs->list); free_fs_devices(fs_devs); + break; } else { fs_devs->num_devices--; list_del(&dev->dev_list);