fix-potential-use-after-free-during-resize

   1 ext4: fix potential use after free during resize
   2
   3 From: Dmitry Monakhov <dmonakhov@openvz.org>
   4
   5 We need some sort of synchronization while updating ->s_group_desc
   6 because there are a lot of users which can access old ->s_group_desc
   7 array after it was released.
   8
   9 Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
  10 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  11 ---
  12  fs/ext4/balloc.c | 12 ++++++++----
  13  fs/ext4/resize.c |  6 ++++--
  14  2 files changed, 12 insertions(+), 6 deletions(-)
  15
  16 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
  17 index 83a6f49..6e2fbbd 100644
  18 --- a/fs/ext4/balloc.c
  19 +++ b/fs/ext4/balloc.c
  20 @@ -282,6 +282,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
  21         unsigned int offset;
  22         ext4_group_t ngroups = ext4_get_groups_count(sb);
  23         struct ext4_group_desc *desc;
  24 +       struct buffer_head *gd_bh;
  25         struct ext4_sb_info *sbi = EXT4_SB(sb);
  26
  27         if (block_group >= ngroups) {
  28 @@ -293,7 +294,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
  29
  30         group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
  31         offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
  32 -       if (!sbi->s_group_desc[group_desc]) {
  33 +       rcu_read_lock();
  34 +       gd_bh = *(rcu_dereference(sbi->s_group_desc) + group_desc);
  35 +       rcu_read_unlock();
  36 +       if (!gd_bh) {
  37                 ext4_error(sb, "Group descriptor not loaded - "
  38                            "block_group = %u, group_desc = %u, desc = %u",
  39                            block_group, group_desc, offset);
  40 @@ -301,10 +305,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
  41         }
  42
  43         desc = (struct ext4_group_desc *)(
  44 -               (__u8 *)sbi->s_group_desc[group_desc]->b_data +
  45 -               offset * EXT4_DESC_SIZE(sb));
  46 +               (__u8 *)gd_bh->b_data + offset * EXT4_DESC_SIZE(sb));
  47         if (bh)
  48 -               *bh = sbi->s_group_desc[group_desc];
  49 +               *bh = gd_bh;
  50 +
  51         return desc;
  52  }
  53
  54 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
  55 index bf76f40..08c2256 100644
  56 --- a/fs/ext4/resize.c
  57 +++ b/fs/ext4/resize.c
  58 @@ -854,8 +854,9 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
  59         memcpy(n_group_desc, o_group_desc,
  60                EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
  61         n_group_desc[gdb_num] = gdb_bh;
  62 -       EXT4_SB(sb)->s_group_desc = n_group_desc;
  63         EXT4_SB(sb)->s_gdb_count++;
  64 +       rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
  65 +       synchronize_rcu();
  66         kvfree(o_group_desc);
  67
  68         le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
  69 @@ -907,8 +908,9 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
  70         memcpy(n_group_desc, o_group_desc,
  71                EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
  72         n_group_desc[gdb_num] = gdb_bh;
  73 -       EXT4_SB(sb)->s_group_desc = n_group_desc;
  74         EXT4_SB(sb)->s_gdb_count++;
  75 +       rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
  76 +       synchronize_rcu();
  77         kvfree(o_group_desc);
  78         BUFFER_TRACE(gdb_bh, "get_write_access");
  79         err = ext4_journal_get_write_access(handle, gdb_bh);