mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-04 09:59:32 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs/btrfs
History
Filipe Manana 421f0922a2 Btrfs: fix use-after-free during inode eviction 
At inode.c:evict_inode_truncate_pages(), when we iterate over the
inode's extent states, we access an extent state record's "state" field
after we unlocked the inode's io tree lock. This can lead to a
use-after-free issue because after we unlock the io tree that extent
state record might have been freed due to being merged into another
adjacent extent state record (a previous inflight bio for a read
operation finished in the meanwhile which unlocked a range in the io
tree and cause a merge of extent state records, as explained in the
comment before the while loop added in commit 6ca0709756 ("Btrfs: fix
hang during inode eviction due to concurrent readahead")).

Fix this by keeping a copy of the extent state's flags in a local
variable and using it after unlocking the io tree.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201189
Fixes: b9d0b38928 ("btrfs: Add handler for invalidate page")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2018-10-19 12:25:33 +02:00
..
tests btrfs: tests: add separate stub for find_lock_delalloc_range 2018-10-15 17:23:34 +02:00
acl.c btrfs: remove unnecessary curly braces in btrfs_get_acl 2018-08-06 13:12:41 +02:00
async-thread.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
async-thread.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
backref.c Btrfs: preftree: use rb_first_cached 2018-10-15 17:23:33 +02:00
backref.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
btrfs_inode.h btrfs: Remove 'objectid' member from struct btrfs_root 2018-10-15 17:23:25 +02:00
check-integrity.c Btrfs: use args in the correct order for kcalloc in btrfsic_read_block 2018-10-15 17:23:30 +02:00
check-integrity.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
compression.c btrfs: remove unused pointer 'tree' in btrfs_submit_compressed_read 2018-10-15 17:23:28 +02:00
compression.h btrfs: compression: Add linux/sizes.h for compression.h 2018-05-29 18:13:00 +02:00
ctree.c Btrfs: fix deadlock when writing out free space caches 2018-10-17 17:46:24 +02:00
ctree.h btrfs: remove fs_info from btrfs_should_throttle_delayed_refs 2018-10-15 17:23:41 +02:00
dedupe.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
delayed-inode.c Btrfs: kill btrfs_clear_path_blocking 2018-10-15 17:23:38 +02:00
delayed-inode.h Btrfs: delayed-inode: use rb_first_cached for ins_root and del_root 2018-10-15 17:23:33 +02:00
delayed-ref.c btrfs: delayed-ref: extract find_first_ref_head from find_ref_head 2018-10-17 19:21:00 +02:00
delayed-ref.h btrfs: delayed-ref: pass delayed_refs directly to btrfs_delayed_ref_lock 2018-10-15 17:23:41 +02:00
dev-replace.c btrfs: dev-replace: remove pointless assert in write unlock 2018-10-15 17:23:38 +02:00
dev-replace.h btrfs: open code btrfs_after_dev_replace_commit 2018-10-15 17:23:37 +02:00
dir-item.c btrfs: Remove root parameter from btrfs_insert_dir_item 2018-10-15 17:23:25 +02:00
disk-io.c btrfs: assert on non-empty delayed iputs 2018-10-15 17:23:39 +02:00
disk-io.h btrfs: unify end_io callbacks of async_submit_bio 2018-08-06 13:12:55 +02:00
export.c btrfs: Remove 'objectid' member from struct btrfs_root 2018-10-15 17:23:25 +02:00
export.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
extent-tree.c btrfs: fix insert_reserved error handling 2018-10-19 12:20:03 +02:00
extent_io.c btrfs: tests: add separate stub for find_lock_delalloc_range 2018-10-15 17:23:34 +02:00
extent_io.h btrfs: tests: add separate stub for find_lock_delalloc_range 2018-10-15 17:23:34 +02:00
extent_map.c Btrfs: extent_map: use rb_first_cached 2018-10-15 17:23:33 +02:00
extent_map.h Btrfs: extent_map: use rb_first_cached 2018-10-15 17:23:33 +02:00
file-item.c btrfs: simplify pointer chasing of local fs_info variables 2018-08-06 13:12:43 +02:00
file.c btrfs: move the dio_sem higher up the callchain 2018-10-19 12:20:04 +02:00
free-space-cache.c btrfs: set max_extent_size properly 2018-10-19 12:20:03 +02:00
free-space-cache.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
free-space-tree.c btrfs: Remove fs_info from btrfs_del_root 2018-08-06 13:13:00 +02:00
free-space-tree.h btrfs: Remove fs_info argument from add_to_free_space_tree 2018-05-28 18:07:36 +02:00
inode-item.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
inode-map.c btrfs: prune unused includes 2018-08-06 13:12:43 +02:00
inode-map.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
inode.c Btrfs: fix use-after-free during inode eviction 2018-10-19 12:25:33 +02:00
ioctl.c btrfs: Ensure btrfs_trim_fs can trim the whole filesystem 2018-10-15 17:23:32 +02:00
Kconfig btrfs: add SPDX header to Kconfig 2018-04-12 16:29:55 +02:00
locking.c btrfs: replace waitqueue_actvie with cond_wake_up 2018-05-28 18:23:09 +02:00
locking.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
lzo.c btrfs: lzo: Harden inline lzo compressed extent decompression 2018-05-30 16:46:43 +02:00
Makefile btrfs: Remove custom crc32c init code 2018-03-26 15:09:39 +02:00
math.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
ordered-data.c btrfs: prune unused includes 2018-08-06 13:12:43 +02:00
ordered-data.h btrfs: remove remaing full_sync logic from btrfs_sync_file 2018-08-06 13:12:31 +02:00
orphan.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
print-tree.c btrfs: annotate unlikely branches after V0 extent type removal 2018-08-06 13:12:41 +02:00
print-tree.h btrfs: print-tree: debugging output enhancement 2018-04-20 19:18:16 +02:00
props.c btrfs: property: Set incompat flag if lzo/zstd compression is set 2018-05-17 14:18:25 +02:00
props.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
qgroup.c btrfs: qgroup: move the qgroup->members check out from (!qgroup)'s else branch 2018-10-15 17:23:40 +02:00
qgroup.h btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled 2018-10-15 17:23:40 +02:00
raid56.c btrfs: raid56: catch errors from full_stripe_write 2018-08-06 13:12:45 +02:00
raid56.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
rcu-string.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
reada.c btrfs: prune unused includes 2018-08-06 13:12:43 +02:00
ref-verify.c btrfs: Remove 'objectid' member from struct btrfs_root 2018-10-15 17:23:25 +02:00
ref-verify.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
relocation.c btrfs: relocation: Remove redundant tree level check 2018-10-15 17:23:40 +02:00
root-tree.c btrfs: Remove fs_info from btrfs_add_root_ref 2018-08-06 13:13:00 +02:00
scrub.c btrfs: open code btrfs_dev_replace_stats_inc 2018-10-15 17:23:37 +02:00
send.c Btrfs: unify error handling of btrfs_lookup_dir_item 2018-10-15 17:23:30 +02:00
send.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
struct-funcs.c btrfs: prune unused includes 2018-08-06 13:12:43 +02:00
super.c btrfs: Remove 'objectid' member from struct btrfs_root 2018-10-15 17:23:25 +02:00
sysfs.c btrfs: prune unused includes 2018-08-06 13:12:43 +02:00
sysfs.h btrfs: sysfs: Use enum/define value for feature array definitions 2018-05-28 18:23:39 +02:00
transaction.c btrfs: don't run delayed_iputs in commit 2018-10-19 12:20:03 +02:00
transaction.h btrfs: replace get_seconds with new 64bit time API 2018-08-06 13:12:29 +02:00
tree-checker.c btrfs: tree-checker: Check level for leaves and nodes 2018-10-15 17:23:37 +02:00
tree-checker.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
tree-defrag.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
tree-log.c btrfs: move the dio_sem higher up the callchain 2018-10-19 12:20:04 +02:00
tree-log.h btrfs: change btrfs_pin_log_trans to return void 2018-10-15 17:23:27 +02:00
ulist.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
ulist.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
uuid-tree.c btrfs: Remove fs_info argument from btrfs_uuid_tree_rem 2018-05-30 16:46:53 +02:00
volumes.c btrfs: open code btrfs_dev_replace_clear_lock_blocking 2018-10-15 17:23:37 +02:00
volumes.h btrfs: Make btrfs_find_device_by_devspec return btrfs_device directly 2018-10-15 17:23:30 +02:00
xattr.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
xattr.h btrfs: replace GPL boilerplate by SPDX -- headers 2018-04-12 16:29:46 +02:00
zlib.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00
zstd.c btrfs: replace GPL boilerplate by SPDX -- sources 2018-04-12 16:29:51 +02:00