6.1-stable patches

added patches:
	btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch

diff --git a/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch b/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch
new file mode 100644 (file)
index 0000000..c37ca15
--- /dev/null
+++ b/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch
@@ -0,0 +1,45 @@
+From 8e7860543a94784d744c7ce34b78a2e11beefa5c Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 4 Jul 2024 16:11:20 +0100
+Subject: btrfs: fix extent map use-after-free when adding pages to compressed bio
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 8e7860543a94784d744c7ce34b78a2e11beefa5c upstream.
+
+At add_ra_bio_pages() we are accessing the extent map to calculate
+'add_size' after we dropped our reference on the extent map, resulting
+in a use-after-free. Fix this by computing 'add_size' before dropping our
+extent map reference.
+
+Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/
+Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible")
+CC: stable@vger.kernel.org # 6.1+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Brennan Lamoreaux <brennan.lamoreaux@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/compression.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -613,6 +613,7 @@ static noinline int add_ra_bio_pages(str
+                       put_page(page);
+                       break;
+               }
++              add_size = min(em->start + em->len, page_end + 1) - cur;
+               free_extent_map(em);
+ 
+               if (page->index == end_index) {
+@@ -625,7 +626,6 @@ static noinline int add_ra_bio_pages(str
+                       }
+               }
+ 
+-              add_size = min(em->start + em->len, page_end + 1) - cur;
+               ret = bio_add_page(cb->orig_bio, page, add_size, offset_in_page(cur));
+               if (ret != add_size) {
+                       unlock_extent(tree, cur, page_end, NULL);

diff --git a/queue-6.1/series b/queue-6.1/series
index fc9724ad64f8001d0fb2fdacbe90d1298c7fa7bf..311979bd4f168204409fdd828a7708f8b0de524d 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -33,3 +33,4 @@ asoc-sof-amd-fix-for-acp-init-sequence.patch
 pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch
 mm-fix-missing-folio-invalidation-calls-during-trunc.patch
 cifs-fix-falloc_fl_punch_hole-support.patch
+btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch