Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
btrfs: Don't free tree_root when exiting btrfs_ioctl_get_subvol_info()
[BUG] When calling BTRF_IOC_GET_SUBVOL_INFO ioctl, we can easily hit the following backtrace: BUG: kernel NULL pointer dereference, address: 0000000000000024 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 27421 Comm: python3 Not tainted 5.6.0-rc1+ torvalds#539 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 RIP: 0010:btrfs_root_node+0x7/0x30 [btrfs] Call Trace: btrfs_read_lock_root_node+0x1f/0x40 [btrfs] btrfs_search_slot+0x60f/0xa40 [btrfs] btrfs_ioctl+0x11f7/0x30b0 [btrfs] ksys_ioctl+0x82/0xc0 __x64_sys_ioctl+0x11/0x20 do_syscall_64+0x43/0x130 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fcb78d43387 ---[ end trace 1c21a7c6c0523b8c ]--- [CAUSE] We're abusing local @root, it's originally a subvolume root, but in root backref search, it's re-assigned to tree_root. Then we call "btrfs_put_root(root);" when exiting. If that @root is reassgined to tree-root, we freed the most important tree, and cause use-after-free. [FIX] Don't re-assgiend @root, use fs_info->tree_root directly. Reported-by: Marcos Paulo de Souza <[email protected]> Fixes: 8c319b6 ("btrfs: hold a ref on the root in btrfs_ioctl_get_subvol_info") [To David: please fold the fix into that commit] Signed-off-by: Qu Wenruo <[email protected]>
- Loading branch information