diff options
| author | Justin M. Forbes <jforbes@redhat.com> | 2012-04-03 17:04:43 -0500 |
|---|---|---|
| committer | Justin M. Forbes <jforbes@redhat.com> | 2012-04-03 17:04:43 -0500 |
| commit | 28582472ab25c8190b0466fc1c2e5ee08648b9d1 (patch) | |
| tree | 50c964a412602181de64f21c2d3a1eb1f062b2f1 | |
| parent | dd4f1a4e5767fcec94e7309f83a2dbf5a80f607f (diff) | |
| download | kernel-28582472ab25c8190b0466fc1c2e5ee08648b9d1.tar.gz kernel-28582472ab25c8190b0466fc1c2e5ee08648b9d1.tar.xz kernel-28582472ab25c8190b0466fc1c2e5ee08648b9d1.zip | |
btrfs use after free
| -rw-r--r-- | btrfs-use-after-free.patch | 71 | ||||
| -rw-r--r-- | kernel.spec | 5 |
2 files changed, 76 insertions, 0 deletions
diff --git a/btrfs-use-after-free.patch b/btrfs-use-after-free.patch new file mode 100644 index 000000000..f277c07bf --- /dev/null +++ b/btrfs-use-after-free.patch @@ -0,0 +1,71 @@ +On Tue, Apr 03, 2012 at 12:50:55PM -0400, Dave Jones wrote: + > On Tue, Apr 03, 2012 at 06:33:43PM +0200, David Sterba wrote: + > > On Tue, Apr 03, 2012 at 12:20:23PM -0400, Dave Jones wrote: + > > > I see a lot of these .. + > > > + > > > btrfs: __btrfs_end_transaction -EIO abored=1802201963 (no super error) + > > + > > 1802201963 == 0x6b6b6b6b + > > + > > #define POISON_FREE 0x6b /* for use-after-free poisoning */ + > > + > > hmm + > + > wait, what... + > + > 535 memset(trans, 0, sizeof(*trans)); + > 536 kmem_cache_free(btrfs_trans_handle_cachep, trans); + > 537 + > 538 if (throttle) + > 539 btrfs_run_delayed_iputs(root); + > 540 + > 541 if (trans->aborted || + > 542 root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) { + > 543 return -EIO; + > 544 } + > + > that looks like a pretty clear use-after-free. + +Ok, trying this.. + + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 8da29e8..11b77a5 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, + struct btrfs_transaction *cur_trans = trans->transaction; + struct btrfs_fs_info *info = root->fs_info; + int count = 0; ++ int err = 0; + + if (--trans->use_count) { + trans->block_rsv = trans->orig_rsv; +@@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, + + if (current->journal_info == trans) + current->journal_info = NULL; +- memset(trans, 0, sizeof(*trans)); +- kmem_cache_free(btrfs_trans_handle_cachep, trans); + + if (throttle) + btrfs_run_delayed_iputs(root); + + if (trans->aborted || + root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) { +- return -EIO; ++ err = -EIO; + } + +- return 0; ++ memset(trans, 0, sizeof(*trans)); ++ kmem_cache_free(btrfs_trans_handle_cachep, trans); ++ return err; + } + + int btrfs_end_transaction(struct btrfs_trans_handle *trans, +-- +To unsubscribe from this list: send the line "unsubscribe linux-kernel" in +the body of a message to majordomo@vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html +Please read the FAQ at http://www.tux.org/lkml/ diff --git a/kernel.spec b/kernel.spec index b08d2bf62..78cce016c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -702,6 +702,7 @@ Patch2900: linux-2.6-v4l-dvb-update.patch Patch2901: linux-2.6-v4l-dvb-experimental.patch # fs fixes +Patch4000: btrfs-use-after-free.patch # NFSv4 @@ -1313,6 +1314,7 @@ ApplyPatch arm-tegra-nvec-kconfig.patch # xfs # btrfs +ApplyPatch btrfs-use-after-free.patch # eCryptfs @@ -2286,6 +2288,9 @@ fi # || || %changelog * Tue Apr 03 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc1.git1.2 +- BTRFS use after free patch + +* Tue Apr 03 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc1.git1.2 - Reenable debugging options. * Tue Apr 03 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc1.git1.1 |