From: Greg Kroah-Hartman Date: Sat, 31 Aug 2024 05:32:00 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v4.19.321~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=efc1ffb6f42dcbee5043b9b099a5cc0350d74bc3;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch --- diff --git a/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch b/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch new file mode 100644 index 00000000000..c37ca157766 --- /dev/null +++ b/queue-6.1/btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch @@ -0,0 +1,45 @@ +From 8e7860543a94784d744c7ce34b78a2e11beefa5c Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Thu, 4 Jul 2024 16:11:20 +0100 +Subject: btrfs: fix extent map use-after-free when adding pages to compressed bio + +From: Filipe Manana + +commit 8e7860543a94784d744c7ce34b78a2e11beefa5c upstream. + +At add_ra_bio_pages() we are accessing the extent map to calculate +'add_size' after we dropped our reference on the extent map, resulting +in a use-after-free. Fix this by computing 'add_size' before dropping our +extent map reference. + +Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/ +Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible") +CC: stable@vger.kernel.org # 6.1+ +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Brennan Lamoreaux +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/compression.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/compression.c ++++ b/fs/btrfs/compression.c +@@ -613,6 +613,7 @@ static noinline int add_ra_bio_pages(str + put_page(page); + break; + } ++ add_size = min(em->start + em->len, page_end + 1) - cur; + free_extent_map(em); + + if (page->index == end_index) { +@@ -625,7 +626,6 @@ static noinline int add_ra_bio_pages(str + } + } + +- add_size = min(em->start + em->len, page_end + 1) - cur; + ret = bio_add_page(cb->orig_bio, page, add_size, offset_in_page(cur)); + if (ret != add_size) { + unlock_extent(tree, cur, page_end, NULL); diff --git a/queue-6.1/series b/queue-6.1/series index fc9724ad64f..311979bd4f1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -33,3 +33,4 @@ asoc-sof-amd-fix-for-acp-init-sequence.patch pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch mm-fix-missing-folio-invalidation-calls-during-trunc.patch cifs-fix-falloc_fl_punch_hole-support.patch +btrfs-fix-extent-map-use-after-free-when-adding-pages-to-compressed-bio.patch