Received: by 2002:a05:6358:5282:b0:b5:90e7:25cb with SMTP id g2csp3326516rwa; Tue, 23 Aug 2022 02:55:07 -0700 (PDT) X-Google-Smtp-Source: AA6agR4qsrnopb2wQ4/4yyp7COnCOvNnj9Jgm7CgOEGknB1uGz3HrXwgeGjGHl9ALYTeB5J87Uvg X-Received: by 2002:a05:6402:5418:b0:435:5a48:daa9 with SMTP id ev24-20020a056402541800b004355a48daa9mr3015534edb.304.1661248507494; Tue, 23 Aug 2022 02:55:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1661248507; cv=none; d=google.com; s=arc-20160816; b=YdEGm9jb0+fIc3UXWssaH5FsPtfp6dE4uZsUokIezDJ1xLDugb5GIIZiZ5e8JEZYqi N1DgRmkSt7EvVlzpHgCzYF7xPa75x7HI78SR/Ymc+0igLEdFK87mtfbDAN0/D/oDwI+p m7LqwjjBZHB4jnVsS3qPYR+F+7JWImGwjPWI3nPtQhZjouuZGTdRTEb0iMoOzrbf+we7 1uWuIrOvxQ85LiDfRa3OAS6opjKpoZOqIrrux9PsRnKMlmbxDygrpdLz8KOcpCA0MV3B ZA+1X1K0CaiPcapL7dFJIBwECxBZsdK35nG25WpZsW8iHD8VZd4hZoYmZHdpiN7/PnOS 56AA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=vLhwYNglSRMzS3UCM2JFubGvULjKkxyX8solUPsOHwk=; b=PwR8OmfHJEQtVQ956eTz8LGLNW3Bpg1xl9P6OTiCK8lx6iQe4FtqIJz1DXeTCIAZOg S2W1bYxBx3XiQkORx60Dlk+rWrqQMXJZTPAC72b/v+e3kW+pDC8mGr/MPSyflhtudVLs RGUmQ+c+4DuDb4P3AGE0yPrXWwwIJy/euTetacODMABfiagYmUZNQ4kch4KLyjnSN/P/ /EN6wTl2A2gRXjZ+WxKONqKGiEoymC5vOUyTeDV9xrxb7MU/5UR9qbOQG8Z1ev9ylM0w 0OJ4UECdgw5AH29+F+EILPiFRYvcJ2lJq0Up+Dt/kIuiuxqx7ahhxajUdJ4qmkYIejQB 4fCg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=blmD1hZB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id gb2-20020a170907960200b00732fd99cdb5si13352365ejc.854.2022.08.23.02.54.41; Tue, 23 Aug 2022 02:55:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=blmD1hZB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240771AbiHWIJ3 (ORCPT + 99 others); Tue, 23 Aug 2022 04:09:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241741AbiHWIIa (ORCPT ); Tue, 23 Aug 2022 04:08:30 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CE6615FD5; Tue, 23 Aug 2022 01:05:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 627C9CE1B29; Tue, 23 Aug 2022 08:05:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6367AC433C1; Tue, 23 Aug 2022 08:05:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661241914; bh=p5L1RJmEecqNIfPyT3QRQLYh4wl0EhjOa21pZM+hFrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=blmD1hZBE3AzsX/24YuZpnPjGCa7S0BkkMIppyf/hCHTmxO23PLQvs4XaYfRxj1Jw JcxkiVxuGmVGssiL5FiI2MMXCvy90kFmOT9xMzjdSx7GQJDkAZr4nRPCpgY2OO6cZP UMaktVlOOLDoMfIWdrj+43ECCxVb39zNdZ0MDNcI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Sweet Tea Dorminy , Nikolay Borisov , Zixuan Fu , David Sterba Subject: [PATCH 5.19 018/365] btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() Date: Tue, 23 Aug 2022 09:58:39 +0200 Message-Id: <20220823080118.950572230@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080118.128342613@linuxfoundation.org> References: <20220823080118.128342613@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zixuan Fu commit 85f02d6c856b9f3a0acf5219de6e32f58b9778eb upstream. In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... Reported-by: TOTE Robot CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Sweet Tea Dorminy Reviewed-by: Nikolay Borisov Signed-off-by: Zixuan Fu Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/relocation.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -3573,7 +3573,12 @@ int prepare_to_relocate(struct reloc_con */ return PTR_ERR(trans); } - return btrfs_commit_transaction(trans); + + ret = btrfs_commit_transaction(trans); + if (ret) + unset_reloc_control(rc); + + return ret; } static noinline_for_stack int relocate_block_group(struct reloc_control *rc)