• Dongliang Mu's avatar
    btrfs: don't access possibly stale fs_info data in device_list_add · 79c9234b
    Dongliang Mu authored
    Syzbot reported a possible use-after-free in printing information
    in device_list_add.
    
    Very similar with the bug fixed by commit 0697d9a6 ("btrfs: don't
    access possibly stale fs_info data for printing duplicate device"),
    but this time the use occurs in btrfs_info_in_rcu.
    
      Call Trace:
       kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
       btrfs_printk+0x395/0x425 fs/btrfs/super.c:244
       device_list_add.cold+0xd7/0x2ed fs/btrfs/volumes.c:957
       btrfs_scan_one_device+0x4c7/0x5c0 fs/btrfs/volumes.c:1387
       btrfs_control_ioctl+0x12a/0x2d0 fs/btrfs/super.c:2409
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    Fix this by modifying device->fs_info to NULL too.
    
    Reported-and-tested-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
    CC: stable@vger.kernel.org # 4.19+
    Signed-off-by: default avatarDongliang Mu <mudongliangabcd@gmail.com>
    Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    79c9234b
volumes.c 225 KB