releases/4.14.86/btrfs-relocation-set-trans-to-be-null-after-ending-transaction.patch

   1 From 42a657f57628402c73237547f0134e083e2f6764 Mon Sep 17 00:00:00 2001
   2 From: Pan Bian <bianpan2016@163.com>
   3 Date: Fri, 23 Nov 2018 18:10:15 +0800
   4 Subject: btrfs: relocation: set trans to be NULL after ending transaction
   5
   6 From: Pan Bian <bianpan2016@163.com>
   7
   8 commit 42a657f57628402c73237547f0134e083e2f6764 upstream.
   9
  10 The function relocate_block_group calls btrfs_end_transaction to release
  11 trans when update_backref_cache returns 1, and then continues the loop
  12 body. If btrfs_block_rsv_refill fails this time, it will jump out the
  13 loop and the freed trans will be accessed. This may result in a
  14 use-after-free bug. The patch assigns NULL to trans after trans is
  15 released so that it will not be accessed.
  16
  17 Fixes: 0647bf564f1 ("Btrfs: improve forever loop when doing balance relocation")
  18 CC: stable@vger.kernel.org # 4.4+
  19 Reviewed-by: Qu Wenruo <wqu@suse.com>
  20 Signed-off-by: Pan Bian <bianpan2016@163.com>
  21 Reviewed-by: David Sterba <dsterba@suse.com>
  22 Signed-off-by: David Sterba <dsterba@suse.com>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24
  25 ---
  26  fs/btrfs/relocation.c |    1 +
  27  1 file changed, 1 insertion(+)
  28
  29 --- a/fs/btrfs/relocation.c
  30 +++ b/fs/btrfs/relocation.c
  31 @@ -4048,6 +4048,7 @@ static noinline_for_stack int relocate_b
  32  restart:
  33                 if (update_backref_cache(trans, &rc->backref_cache)) {
  34                         btrfs_end_transaction(trans);
  35 +                       trans = NULL;
  36                         continue;
  37                 }
  38