This is a note to let you know that I've just added the patch titled
btrfs: free btrfs_path before copying inodes to userspace
to the 6.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
btrfs-free-btrfs_path-before-copying-inodes-to-userspace.patch
and it can be found in the queue-6.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 418ffb9e3cf6c4e2574d3a732b724916684bd133 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain@xxxxxxxxxx>
Date: Thu, 10 Nov 2022 11:36:28 +0530
Subject: btrfs: free btrfs_path before copying inodes to userspace
From: Anand Jain <anand.jain@xxxxxxxxxx>
commit 418ffb9e3cf6c4e2574d3a732b724916684bd133 upstream.
btrfs_ioctl_logical_to_ino() frees the search path after the userspace
copy from the temp buffer @inodes. Which potentially can lead to a lock
splat.
Fix this by freeing the path before we copy @inodes to userspace.
CC: stable@xxxxxxxxxxxxxxx # 4.19+
Signed-off-by: Anand Jain <anand.jain@xxxxxxxxxx>
Reviewed-by: David Sterba <dsterba@xxxxxxxx>
Signed-off-by: David Sterba <dsterba@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/btrfs/ioctl.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(s
size = min_t(u32, loi->size, SZ_16M);
}
- path = btrfs_alloc_path();
- if (!path) {
- ret = -ENOMEM;
- goto out;
- }
-
inodes = init_data_container(size);
if (IS_ERR(inodes)) {
ret = PTR_ERR(inodes);
- inodes = NULL;
- goto out;
+ goto out_loi;
}
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
inodes, ignore_offset);
+ btrfs_free_path(path);
if (ret == -EINVAL)
ret = -ENOENT;
if (ret < 0)
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(s
ret = -EFAULT;
out:
- btrfs_free_path(path);
kvfree(inodes);
out_loi:
kfree(loi);
Patches currently in stable-queue which might be from anand.jain@xxxxxxxxxx are
queue-6.0/btrfs-free-btrfs_path-before-copying-fspath-to-userspace.patch
queue-6.0/btrfs-free-btrfs_path-before-copying-subvol-info-to-userspace.patch
queue-6.0/btrfs-free-btrfs_path-before-copying-inodes-to-userspace.patch
queue-6.0/btrfs-free-btrfs_path-before-copying-root-refs-to-userspace.patch
