mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 10:40:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

btrfs: fix use-after-free waiting for encoded read endios

Browse source 
Fix a use-after-free in the I/O completion path for encoded reads by
using a completion instead of a wait_queue for synchronizing the
destruction of 'struct btrfs_encoded_read_private'.

Fixes: 1881fba89b ("btrfs: add BTRFS_IOC_ENCODED_READ ioctl")
CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Johannes Thumshirn 2024-11-13 18:16:49 +01:00 committed by David Sterba
parent f10bef73fb
commit d29662695e
1 changed files with 11 additions and 11 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

22
fs/btrfs/inode.c
View file

@ -9078,9 +9078,9 @@ static ssize_t btrfs_encoded_read_inline(
} }
struct btrfs_encoded_read_private { struct btrfs_encoded_read_private {
wait_queue_head_t wait; struct completion done;
void *uring_ctx; void *uring_ctx;
atomic_t pending; refcount_t pending_refs;
blk_status_t status; blk_status_t status;
}; };
@ -9099,14 +9099,14 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio)
*/ */
WRITE_ONCE(priv->status, bbio->bio.bi_status); WRITE_ONCE(priv->status, bbio->bio.bi_status);
} }
if (atomic_dec_and_test(&priv->pending)) { if (refcount_dec_and_test(&priv->pending_refs)) {
int err = blk_status_to_errno(READ_ONCE(priv->status)); int err = blk_status_to_errno(READ_ONCE(priv->status));
if (priv->uring_ctx) { if (priv->uring_ctx) {
btrfs_uring_read_extent_endio(priv->uring_ctx, err); btrfs_uring_read_extent_endio(priv->uring_ctx, err);
kfree(priv); kfree(priv);
} else { } else {
wake_up(&priv->wait); complete(&priv->done);
} }
} }
bio_put(&bbio->bio); bio_put(&bbio->bio);
@ -9126,8 +9126,8 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
if (!priv) if (!priv)
return -ENOMEM; return -ENOMEM;
init_waitqueue_head(&priv->wait); init_completion(&priv->done);
atomic_set(&priv->pending, 1); refcount_set(&priv->pending_refs, 1);
priv->status = 0; priv->status = 0;
priv->uring_ctx = uring_ctx; priv->uring_ctx = uring_ctx;
@ -9140,7 +9140,7 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
size_t bytes = min_t(u64, disk_io_size, PAGE_SIZE); size_t bytes = min_t(u64, disk_io_size, PAGE_SIZE);
if (bio_add_page(&bbio->bio, pages[i], bytes, 0) < bytes) { if (bio_add_page(&bbio->bio, pages[i], bytes, 0) < bytes) {
atomic_inc(&priv->pending); refcount_inc(&priv->pending_refs);
btrfs_submit_bbio(bbio, 0); btrfs_submit_bbio(bbio, 0);
bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info, bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
@ -9155,11 +9155,11 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
disk_io_size -= bytes; disk_io_size -= bytes;
} while (disk_io_size); } while (disk_io_size);
atomic_inc(&priv->pending); refcount_inc(&priv->pending_refs);
btrfs_submit_bbio(bbio, 0); btrfs_submit_bbio(bbio, 0);
if (uring_ctx) { if (uring_ctx) {
if (atomic_dec_return(&priv->pending) == 0) { if (refcount_dec_and_test(&priv->pending_refs)) {
ret = blk_status_to_errno(READ_ONCE(priv->status)); ret = blk_status_to_errno(READ_ONCE(priv->status));
btrfs_uring_read_extent_endio(uring_ctx, ret); btrfs_uring_read_extent_endio(uring_ctx, ret);
kfree(priv); kfree(priv);
@ -9168,8 +9168,8 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
return -EIOCBQUEUED; return -EIOCBQUEUED;
} else { } else {
if (atomic_dec_return(&priv->pending) != 0) if (!refcount_dec_and_test(&priv->pending_refs))
io_wait_event(priv->wait, !atomic_read(&priv->pending)); wait_for_completion_io(&priv->done);
/* See btrfs_encoded_read_endio() for ordering. */ /* See btrfs_encoded_read_endio() for ordering. */
ret = blk_status_to_errno(READ_ONCE(priv->status)); ret = blk_status_to_errno(READ_ONCE(priv->status));
kfree(priv); kfree(priv);