Commit 211c581d authored by Pei Li's avatar Pei Li Committed by Kent Overstreet
Browse files

bcachefs: slab-use-after-free Read in bch2_sb_errors_from_cpu 



Acquire fsck_error_counts_lock before accessing the critical section
protected by this lock.

syzbot has tested the proposed patch and the reproducer did not trigger
any issue.

Reported-by: default avatar <syzbot+a2bc0e838efd7663f4d9@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=a2bc0e838efd7663f4d9


Signed-off-by: default avatarPei Li <peili.dev@gmail.com>
Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
parent 89d21b69

fs/bcachefs/sb-errors.c

+10 −4
Original line number Diff line number Diff line
@@ -110,19 +110,25 @@ void bch2_sb_error_count(struct bch_fs *c, enum bch_sb_error_id err) 
void bch2_sb_errors_from_cpu(struct bch_fs *c)

{

	bch_sb_errors_cpu *src = &c->fsck_error_counts;

	struct bch_sb_field_errors *dst =

		bch2_sb_field_resize(&c->disk_sb, errors,

				     bch2_sb_field_errors_u64s(src->nr));

	struct bch_sb_field_errors *dst;

	unsigned i;



	mutex_lock(&c->fsck_error_counts_lock);



	dst = bch2_sb_field_resize(&c->disk_sb, errors,

				   bch2_sb_field_errors_u64s(src->nr));



	if (!dst)

		return;

		goto err;



	for (i = 0; i < src->nr; i++) {

		SET_BCH_SB_ERROR_ENTRY_ID(&dst->entries[i], src->data[i].id);

		SET_BCH_SB_ERROR_ENTRY_NR(&dst->entries[i], src->data[i].nr);

		dst->entries[i].last_error_time = cpu_to_le64(src->data[i].last_error_time);

	}



err:

	mutex_unlock(&c->fsck_error_counts_lock);

}



static int bch2_sb_errors_to_cpu(struct bch_fs *c)