Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp1270200pxa; Thu, 20 Aug 2020 07:11:57 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxCkplXWGTVMaGoGD1ztSuxyyNxOZHgwvFTeC/rfYAnIKXImyZHbklfHKb0HAGyzO7AV3V/ X-Received: by 2002:a17:906:6801:: with SMTP id k1mr3445406ejr.492.1597932717027; Thu, 20 Aug 2020 07:11:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597932717; cv=none; d=google.com; s=arc-20160816; b=axDn7waya+xRf1QRtRxURoZAX9yTwR/ncAn/Hm1gn9o+yz663Mw19YKQ65MvbuaZt2 QReBaU/klYroE0cATt94zicVDm/AgI3vZwmA5BDOvm3prJ62a0nbojRbKkiHDqXW0Euo W1myjs4QmhgkYVysSvlIyl4OGMKz79HNPCwUNpy117Kx+f8B/RTIqdCpwocT1NbFvD6c FPiJe63UGsbhNPbjA+LvEeVCOjS+YI4+hKy/0ZcF7Ca6rGwgVIcmpqcxPzhRmt8aNKVQ wRSInm78yYQqtmnZMhMjwLtaTT9+E9gdGnRpJs/Hv5MnbSNPXbbCBk3LmpNLNR7n0ZUO Tc1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=279+FItjtjYqBwwQMAs//7etAChz/JXOvjfTbYRDvM4=; b=Go8AOtrkUh9/7WBM8rK65fS8tc5e0aadN1FactK6yIN/1GOBkxbLbsVAieLR/oMy5l eDoKYBPftetFd3T0CDO7YOIFcaG8M8LbcBQgkUjgoCFSyXD7bicYv7IoMhk1893kuCF1 +lD/A1xQ/47fh/v+2qXAQj/lmPrZKhjZ+Fn6TRKpeXg6LjmEzOouVuBkK6BdlDru4Jfi jhsfp3O8FgE41eLcjbetAiIOpT/gSBKtQd3Z2nxzVKQQjPt3+0L+eOIfqbd41Iu3wfC3 kkFYvOgC3lwmQ5aRcMzS9rAYkF3cZpxdAFQCiu3wzk6XZ2i8gGm5FbOPSdjxZsxnDtoS Jkpg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ZoZILDm5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ks26si1324353ejb.90.2020.08.20.07.11.33; Thu, 20 Aug 2020 07:11:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ZoZILDm5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728838AbgHTNzS (ORCPT + 99 others); Thu, 20 Aug 2020 09:55:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:35382 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727878AbgHTJ0Y (ORCPT ); Thu, 20 Aug 2020 05:26:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 51C0521744; Thu, 20 Aug 2020 09:26:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597915583; bh=oG7drFKVpZT0RAyA0Uv8sAuQrakfpwD8Vf9tsuizcKA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZoZILDm53iR/Vorq9fQXXgOgXTAzUhnCNKajd/gXnp/KLkVoA73upJzxWopff8TVf Vx5XbXXB6k+/hk8TFq+v+sgWBU5HdfieYoDJizVcBIlIDGzspxiUNKrS/wZdrX+Kkz kDTrBIRj3Ka4AD0WB6y1wkkHVBMRQgNF7zjN4OAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba Subject: [PATCH 5.8 035/232] btrfs: only search for left_info if there is no right_info in try_merge_free_space Date: Thu, 20 Aug 2020 11:18:06 +0200 Message-Id: <20200820091614.468076323@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820091612.692383444@linuxfoundation.org> References: <20200820091612.692383444@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Josef Bacik commit bf53d4687b8f3f6b752f091eb85f62369a515dfd upstream. In try_to_merge_free_space we attempt to find entries to the left and right of the entry we are adding to see if they can be merged. We search for an entry past our current info (saved into right_info), and then if right_info exists and it has a rb_prev() we save the rb_prev() into left_info. However there's a slight problem in the case that we have a right_info, but no entry previous to that entry. At that point we will search for an entry just before the info we're attempting to insert. This will simply find right_info again, and assign it to left_info, making them both the same pointer. Now if right_info _can_ be merged with the range we're inserting, we'll add it to the info and free right_info. However further down we'll access left_info, which was right_info, and thus get a use-after-free. Fix this by only searching for the left entry if we don't find a right entry at all. The CVE referenced had a specially crafted file system that could trigger this use-after-free. However with the tree checker improvements we no longer trigger the conditions for the UAF. But the original conditions still apply, hence this fix. Reference: CVE-2019-19448 Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/free-space-cache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/btrfs/free-space-cache.c +++ b/fs/btrfs/free-space-cache.c @@ -2281,7 +2281,7 @@ out: static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, struct btrfs_free_space *info, bool update_stat) { - struct btrfs_free_space *left_info; + struct btrfs_free_space *left_info = NULL; struct btrfs_free_space *right_info; bool merged = false; u64 offset = info->offset; @@ -2297,7 +2297,7 @@ static bool try_merge_free_space(struct if (right_info && rb_prev(&right_info->offset_index)) left_info = rb_entry(rb_prev(&right_info->offset_index), struct btrfs_free_space, offset_index); - else + else if (!right_info) left_info = tree_search_offset(ctl, offset - 1, 0, 0); /* See try_merge_free_space() comment. */