mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-22 18:41:06 +00:00
btrfs: fix extent map use-after-free when adding pages to compressed bio
commit8e7860543a
upstream. At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference. Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/ Fixes:6a40491020
("btrfs: subpage: make add_ra_bio_pages() compatible") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5a041d25b6
commit
c205565e0f
1 changed files with 1 additions and 1 deletions
|
@ -420,6 +420,7 @@ static noinline int add_ra_bio_pages(struct inode *inode,
|
|||
put_page(page);
|
||||
break;
|
||||
}
|
||||
add_size = min(em->start + em->len, page_end + 1) - cur;
|
||||
free_extent_map(em);
|
||||
|
||||
if (page->index == end_index) {
|
||||
|
@ -432,7 +433,6 @@ static noinline int add_ra_bio_pages(struct inode *inode,
|
|||
}
|
||||
}
|
||||
|
||||
add_size = min(em->start + em->len, page_end + 1) - cur;
|
||||
ret = bio_add_page(orig_bio, page, add_size, offset_in_page(cur));
|
||||
if (ret != add_size) {
|
||||
unlock_extent(tree, cur, page_end, NULL);
|
||||
|
|
Loading…
Reference in a new issue