queue-4.19/ext4-fix-use-after-free-in-dx_release.patch

   1 From 08fc98a4d6424af66eb3ac4e2cedd2fc927ed436 Mon Sep 17 00:00:00 2001
   2 From: Sahitya Tummala <stummala@codeaurora.org>
   3 Date: Fri, 10 May 2019 22:00:33 -0400
   4 Subject: ext4: fix use-after-free in dx_release()
   5
   6 From: Sahitya Tummala <stummala@codeaurora.org>
   7
   8 commit 08fc98a4d6424af66eb3ac4e2cedd2fc927ed436 upstream.
   9
  10 The buffer_head (frames[0].bh) and it's corresping page can be
  11 potentially free'd once brelse() is done inside the for loop
  12 but before the for loop exits in dx_release(). It can be free'd
  13 in another context, when the page cache is flushed via
  14 drop_caches_sysctl_handler(). This results into below data abort
  15 when accessing info->indirect_levels in dx_release().
  16
  17 Unable to handle kernel paging request at virtual address ffffffc17ac3e01e
  18 Call trace:
  19  dx_release+0x70/0x90
  20  ext4_htree_fill_tree+0x2d4/0x300
  21  ext4_readdir+0x244/0x6f8
  22  iterate_dir+0xbc/0x160
  23  SyS_getdents64+0x94/0x174
  24
  25 Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
  26 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  27 Reviewed-by: Andreas Dilger <adilger@dilger.ca>
  28 Cc: stable@kernel.org
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  fs/ext4/namei.c |    5 ++++-
  33  1 file changed, 4 insertions(+), 1 deletion(-)
  34
  35 --- a/fs/ext4/namei.c
  36 +++ b/fs/ext4/namei.c
  37 @@ -871,12 +871,15 @@ static void dx_release(struct dx_frame *
  38  {
  39         struct dx_root_info *info;
  40         int i;
  41 +       unsigned int indirect_levels;
  42
  43         if (frames[0].bh == NULL)
  44                 return;
  45
  46         info = &((struct dx_root *)frames[0].bh->b_data)->info;
  47 -       for (i = 0; i <= info->indirect_levels; i++) {
  48 +       /* save local copy, "info" may be freed after brelse() */
  49 +       indirect_levels = info->indirect_levels;
  50 +       for (i = 0; i <= indirect_levels; i++) {
  51                 if (frames[i].bh == NULL)
  52                         break;
  53                 brelse(frames[i].bh);