Commit ae3e54b7 authored by Baokun Li's avatar Baokun Li Committed by Yongjian Sun
Browse files

ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free 

mainline inclusion
from mainline-v6.12-rc1
commit 5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8P
CVE: CVE-2024-49983

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95



--------------------------------

When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),
the 'ppath' is updated but it is the 'path' that is freed, thus potentially
triggering a double-free in the following process:

ext4_ext_replay_update_ex
  ppath = path
  ext4_force_split_extent_at(&ppath)
    ext4_split_extent_at
      ext4_ext_insert_extent
        ext4_ext_create_new_leaf
          ext4_ext_grow_indepth
            ext4_find_extent
              if (depth > path[0].p_maxdepth)
                kfree(path)                 ---> path First freed
                *orig_path = path = NULL    ---> null ppath
  kfree(path)                               ---> path double-free !!!

So drop the unnecessary ppath and use path directly to avoid this problem.
And use ext4_find_extent() directly to update path, avoiding unnecessary
memory allocation and freeing. Also, propagate the error returned by
ext4_find_extent() instead of using strange error codes.

Fixes: 8016e29f ("ext4: fast commit recovery path")
Cc: stable@kernel.org
Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Reviewed-by: default avatarOjaswin Mujoo <ojaswin@linux.ibm.com>
Tested-by: default avatarOjaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20240822023545.1994557-8-libaokun@huaweicloud.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarYongjian Sun <sunyongjian1@huawei.com>
parent f57c7b29

fs/ext4/extents.c

+10 −11
Original line number Diff line number Diff line
@@ -5950,7 +5950,7 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu) 
int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start,

			      int len, int unwritten, ext4_fsblk_t pblk)

{

	struct ext4_ext_path *path = NULL, *ppath;

	struct ext4_ext_path *path;

	struct ext4_extent *ex;

	int ret;
@@ -5966,30 +5966,29 @@ int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start, 
	if (le32_to_cpu(ex->ee_block) != start ||

		ext4_ext_get_actual_len(ex) != len) {

		/* We need to split this extent to match our extent first */

		ppath = path;

		down_write(&EXT4_I(inode)->i_data_sem);

		ret = ext4_force_split_extent_at(NULL, inode, &ppath, start, 1);

		ret = ext4_force_split_extent_at(NULL, inode, &path, start, 1);

		up_write(&EXT4_I(inode)->i_data_sem);

		if (ret)

			goto out;

		kfree(path);

		path = ext4_find_extent(inode, start, NULL, 0);



		path = ext4_find_extent(inode, start, &path, 0);

		if (IS_ERR(path))

			return -1;

		ppath = path;

			return PTR_ERR(path);

		ex = path[path->p_depth].p_ext;

		WARN_ON(le32_to_cpu(ex->ee_block) != start);



		if (ext4_ext_get_actual_len(ex) != len) {

			down_write(&EXT4_I(inode)->i_data_sem);

			ret = ext4_force_split_extent_at(NULL, inode, &ppath,

			ret = ext4_force_split_extent_at(NULL, inode, &path,

							 start + len, 1);

			up_write(&EXT4_I(inode)->i_data_sem);

			if (ret)

				goto out;

			kfree(path);

			path = ext4_find_extent(inode, start, NULL, 0);



			path = ext4_find_extent(inode, start, &path, 0);

			if (IS_ERR(path))

				return -EINVAL;

				return PTR_ERR(path);

			ex = path[path->p_depth].p_ext;

		}

	}