Commit 6a9dfc35 authored Jan 08, 2025 by Filipe Manana Committed by Yifan Qiao Jan 08, 2025

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

mainline inclusion
from mainline-v6.13-rc5
commit 44f52bbe96dfdbe4aca3818a2534520082a07040
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK
CVE: CVE-2024-56759

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=44f52bbe96dfdbe4aca3818a2534520082a07040



--------------------------------

When a COWing a tree block, at btrfs_cow_block(), and we have the
tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled
(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent
buffer while inside the tracepoint code. This is because in some paths
that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding
the last reference on the extent buffer @buf so btrfs_force_cow_block()
drops the last reference on the @buf extent buffer when it calls
free_extent_buffer_stale(buf), which schedules the release of the extent
buffer with RCU. This means that if we are on a kernel with preemption,
the current task may be preempted before calling trace_btrfs_cow_block()
and the extent buffer already released by the time trace_btrfs_cow_block()
is called, resulting in a use-after-free.

Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to
btrfs_force_cow_block() before the COWed extent buffer is freed.
This also has a side effect of invoking the tracepoint in the tree defrag
code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is
called there, but this is fine and it was actually missing there.

Reported-by:  <syzbot+8517da8635307182c8a5@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@google.com/


CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Conflicts:
	fs/btrfs/ctree.c
[__btrfs_cow_block did not rename to btrfs_force_cow_block yet.]
Signed-off-by: Yifan Qiao <qiaoyifan4@huawei.com>

parent a6a98ae1

fs/btrfs/ctree.c

+3 −6

Original line number	Diff line number	Diff line
		@@ -1127,6 +1127,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
		btrfs_free_tree_block(trans, root, buf, parent_start,
		last_ref);
		}

		trace_btrfs_cow_block(root, buf, cow);
		if (unlock_orig)
		btrfs_tree_unlock(buf);
		free_extent_buffer_stale(buf);
		@@ -1493,7 +1495,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
		{
		struct btrfs_fs_info *fs_info = root->fs_info;
		u64 search_start;
		int ret;

		if (test_bit(BTRFS_ROOT_DELETING, &root->state))
		btrfs_err(fs_info,
		@@ -1527,12 +1528,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
		* Also We don't care about the error, as it's handled internally.
		*/
		btrfs_qgroup_trace_subtree_after_cow(trans, root, buf);
		ret = __btrfs_cow_block(trans, root, buf, parent,
		return __btrfs_cow_block(trans, root, buf, parent,
		parent_slot, cow_ret, search_start, 0, nest);

		trace_btrfs_cow_block(root, buf, *cow_ret);

		return ret;
		}

		/*