xfs: fix UAF in xchk_btree_check_block_owner

We cannot dereference bs->cur when trying to determine if bs->cur
aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed.
Fix this by sampling before type before any freeing could happen.
The correct temporal ordering was broken when we removed xfs_btnum_t.

Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.9
Fixes: ec793e690f801d ("xfs: remove xfs_btnum_t")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>

diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index 40f36db9f07d528928880913da766017b10884e6..1089b1f4c5df4340e7bfa0677fe6861d6735a125 100644 (file)
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -372,12 +372,15 @@ xchk_btree_check_block_owner(
 {
        xfs_agnumber_t          agno;
        xfs_agblock_t           agbno;
+       bool                    is_bnobt, is_rmapbt;
        bool                    init_sa;
        int                     error = 0;
 
        if (!bs->cur)
                return 0;
 
+       is_bnobt = xfs_btree_is_bno(bs->cur->bc_ops);
+       is_rmapbt = xfs_btree_is_rmap(bs->cur->bc_ops);
        agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
        agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
 
@@ -400,11 +403,11 @@ xchk_btree_check_block_owner(
         * have to nullify it (to shut down further block owner checks) if
         * self-xref encounters problems.
         */
-       if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
+       if (!bs->sc->sa.bno_cur && is_bnobt)
                bs->cur = NULL;
 
        xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
-       if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
+       if (!bs->sc->sa.rmap_cur && is_rmapbt)
                bs->cur = NULL;
 
 out_free: