Patch "btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     btrfs-fix-use-after-free-of-block-device-file-in-__b.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 51a566b2d28380de4fe53a243104685e9e5fbc55
Author: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
Date:   Mon Oct 21 22:02:15 2024 +0800

    btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
    
    [ Upstream commit aec8e6bf839101784f3ef037dcdb9432c3f32343 ]
    
    Mounting btrfs from two images (which have the same one fsid and two
    different dev_uuids) in certain executing order may trigger an UAF for
    variable 'device->bdev_file' in __btrfs_free_extra_devids(). And
    following are the details:
    
    1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs
       devices by ioctl(BTRFS_IOC_SCAN_DEV):
    
                 /  btrfs_device_1 → loop0
       fs_device
                 \  btrfs_device_2 → loop1
    2. mount /dev/loop0 /mnt
       btrfs_open_devices
        btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0)
        btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1)
       btrfs_fill_super
        open_ctree
         fail: btrfs_close_devices // -ENOMEM
                btrfs_close_bdev(btrfs_device_1)
                 fput(btrfs_device_1->bdev_file)
                  // btrfs_device_1->bdev_file is freed
                btrfs_close_bdev(btrfs_device_2)
                 fput(btrfs_device_2->bdev_file)
    
    3. mount /dev/loop1 /mnt
       btrfs_open_devices
        btrfs_get_bdev_and_sb(&bdev_file)
         // EIO, btrfs_device_1->bdev_file is not assigned,
         // which points to a freed memory area
        btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1)
       btrfs_fill_super
        open_ctree
         btrfs_free_extra_devids
          if (btrfs_device_1->bdev_file)
           fput(btrfs_device_1->bdev_file) // UAF !
    
    Fix it by setting 'device->bdev_file' as 'NULL' after closing the
    btrfs_device in btrfs_close_one_device().
    
    Fixes: 142388194191 ("btrfs: do not background blkdev_put()")
    CC: stable@xxxxxxxxxxxxxxx # 4.19+
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=219408
    Signed-off-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
    Reviewed-by: David Sterba <dsterba@xxxxxxxx>
    Signed-off-by: David Sterba <dsterba@xxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index fcedc43ef291a..0485143cd75e0 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1103,6 +1103,7 @@ static void btrfs_close_one_device(struct btrfs_device *device)
 	if (device->bdev) {
 		fs_devices->open_devices--;
 		device->bdev = NULL;
+		device->bdev_file = NULL;
 	}
 	clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state);
 	btrfs_destroy_dev_zone_info(device);