6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Filipe Manana <fdmanana@xxxxxxxx> commit 8e7860543a94784d744c7ce34b78a2e11beefa5c upstream. At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference. Reported-by: syzbot+853d80cba98ce1157ae6@xxxxxxxxxxxxxxxxxxxxxxxxx Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@xxxxxxxxxx/ Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible") CC: stable@xxxxxxxxxxxxxxx # 6.1+ Signed-off-by: Filipe Manana <fdmanana@xxxxxxxx> Reviewed-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/btrfs/compression.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/btrfs/compression.c +++ b/fs/btrfs/compression.c @@ -420,6 +420,7 @@ static noinline int add_ra_bio_pages(str put_page(page); break; } + add_size = min(em->start + em->len, page_end + 1) - cur; free_extent_map(em); if (page->index == end_index) { @@ -432,7 +433,6 @@ static noinline int add_ra_bio_pages(str } } - add_size = min(em->start + em->len, page_end + 1) - cur; ret = bio_add_page(orig_bio, page, add_size, offset_in_page(cur)); if (ret != add_size) { unlock_extent(tree, cur, page_end, NULL);
