xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4dc0484e90a3cde1cb1514f1db1de3145d99cb18
android_kernel_xiaomi_sm8450/fs/nilfs2
History
Pan Bian 7130a87ca3 nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() 
commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream.

In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the
reference count of bh when the call to nilfs_dat_translate() fails.  If
the reference count hits 0 and its owner page gets unlocked, bh may be
freed.  However, bh->b_page is dereferenced to put the page after that,
which may result in a use-after-free bug.  This patch moves the release
operation after unlocking and putting the page.

NOTE: The function in question is only called in GC, and in combination
with current userland tools, address translation using DAT does not occur
in that function, so the code path that causes this issue will not be
executed.  However, it is possible to run that code path by intentionally
modifying the userland GC library or by calling the GC ioctl directly.

[konishi.ryusuke@gmail.com: NOTE added to the commit log]
Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163.com
Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com
Fixes: a3d93f709e ("nilfs2: block cache for garbage collection")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reported-by: Ferry Meng <mengferry@linux.alibaba.com>
Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-10 21:53:34 +02:00
..
alloc.c
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
2023-09-19 12:20:03 +02:00
alloc.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
bmap.c
nilfs2: fix infinite loop in nilfs_mdt_get_block()
2023-05-17 11:47:36 +02:00
bmap.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
btnode.c
nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
2023-06-21 15:45:37 +02:00
btnode.h
nilfs2: fix lockdep warnings in page operations for btree nodes
2022-05-25 09:17:54 +02:00
btree.c
nilfs2: fix general protection fault in nilfs_btree_insert()
2023-01-24 07:19:56 +01:00
btree.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
cpfile.c
nilfs2: fix some kernel-doc warnings for nilfs2
2020-10-16 11:11:22 -07:00
cpfile.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
dat.c
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
2022-12-08 11:23:57 +01:00
dat.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
dir.c
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
direct.c
nilfs2: use a more common logging style
2020-08-12 10:58:01 -07:00
direct.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
export.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
file.c
nilfs2: make splice write available again
2021-02-13 13:55:16 +01:00
gcinode.c
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
2023-10-10 21:53:34 +02:00
ifile.c
nilfs2: use a more common logging style
2020-08-12 10:58:01 -07:00
ifile.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
inode.c
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
2023-09-19 12:20:03 +02:00
ioctl.c
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
2023-04-05 11:23:41 +02:00
Kconfig
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
Makefile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mdt.c
nilfs2: fix lockdep warnings during disk space reclamation
2022-05-25 09:17:54 +02:00
mdt.h
nilfs2: fix lockdep warnings during disk space reclamation
2022-05-25 09:17:54 +02:00
namei.c
nilfs2: use a more common logging style
2020-08-12 10:58:01 -07:00
nilfs.h
nilfs2: fix incorrect masking of permission flags for symlinks
2022-07-21 21:20:01 +02:00
page.c
nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
2023-06-28 10:28:09 +02:00
page.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
recovery.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
segbuf.c
nilfs2: fix buffer corruption due to concurrent device reads
2023-06-28 10:28:07 +02:00
segbuf.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
segment.c
nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
2023-09-19 12:20:03 +02:00
segment.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
sufile.c
nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
2023-06-21 15:45:37 +02:00
sufile.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
super.c
nilfs2: fix buffer corruption due to concurrent device reads
2023-06-28 10:28:07 +02:00
sysfs.c
nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
2021-09-26 14:09:01 +02:00
sysfs.h
nilfs2: convert to SPDX license tags
2018-09-04 16:45:02 -07:00
the_nilfs.c
nilfs2: reject devices with insufficient block count
2023-06-21 15:45:41 +02:00
the_nilfs.h
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
2023-08-16 18:21:00 +02:00