diff options
| author | Filipe Manana <fdmanana@suse.com> | 2024-07-04 18:11:20 +0300 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2024-07-11 17:32:22 +0300 |
| commit | 8e7860543a94784d744c7ce34b78a2e11beefa5c (patch) | |
| tree | 9fd6c89883a59adce50cf5604e6a33520c30dd47 /fs/btrfs/super.c | |
| parent | 320d8dc612660da84c3b70a28658bb38069e5a9a (diff) | |
| download | linux-8e7860543a94784d744c7ce34b78a2e11beefa5c.tar.xz | |
btrfs: fix extent map use-after-free when adding pages to compressed bio
At add_ra_bio_pages() we are accessing the extent map to calculate
'add_size' after we dropped our reference on the extent map, resulting
in a use-after-free. Fix this by computing 'add_size' before dropping our
extent map reference.
Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/
Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/super.c')
0 files changed, 0 insertions, 0 deletions