| Message ID | 20210911090059.1876456-5-yebin10@huawei.com |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | Fix some issues about mmp | expand |
On Sat 11-09-21 17:00:57, Ye Bin wrote: > As call read_mmp_block pass bh_check which value is NULL, then call > sb_getblk to get buffer_head. But mmp_block's buffer_head is already exist > which also is uptodate. Lead to compare the same data. > > Signed-off-by: Ye Bin <yebin10@huawei.com> This looks good, except that read_mmp_block() also releases bh it is passed in case of error. So it can free buffer head which is still referenced from EXT4_SB(sb)->s_mmp_bh and cause use-after-free issues. I guess I would just get rid of sb_getblk() in read_mmp_block() and always expect valid bh passed. The only place that passes NULL bh after this patch is one case in ext4_multi_mount_protect() and that can call sb_getblk() on its own. That way we can also simplify read_mmp_block() prototype to: static int read_mmp_block(struct super_block *sb, struct buffer_head *bh); Honza > --- > fs/ext4/mmp.c | 17 ++++++----------- > 1 file changed, 6 insertions(+), 11 deletions(-) > > diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c > index 4433fe7e9e86..007bde3c12b8 100644 > --- a/fs/ext4/mmp.c > +++ b/fs/ext4/mmp.c > @@ -213,10 +213,7 @@ static int kmmpd(void *data) > * we need to check if the MMP block is as we write it. > */ > if (jiffies - last_check_time > mmp_check_interval * HZ) { > - struct buffer_head *bh_check = NULL; > - struct mmp_struct *mmp_check; > - > - retval = read_mmp_block(sb, &bh_check, mmp_block); > + retval = read_mmp_block(sb, &bh, mmp_block); > if (retval) { > ext4_error_err(sb, -retval, > "error reading MMP data: %d", > @@ -224,20 +221,18 @@ static int kmmpd(void *data) > goto wait_to_exit; > } > > - mmp_check = (struct mmp_struct *)(bh_check->b_data); > - if (seq != mmp_check->mmp_seq || > - memcmp(nodename, mmp_check->mmp_nodename, > - sizeof(mmp->mmp_nodename))) { > - dump_mmp_msg(sb, mmp_check, > + mmp = (struct mmp_struct *)(bh->b_data); > + if (seq != le32_to_cpu(mmp->mmp_seq) || > + memcmp(nodename, mmp->mmp_nodename, > + sizeof(nodename))) { > + dump_mmp_msg(sb, mmp, > "Error while updating MMP info. " > "The filesystem seems to have been" > " multiply mounted."); > ext4_error_err(sb, EBUSY, "abort"); > - put_bh(bh_check); > retval = -EBUSY; > goto wait_to_exit; > } > - put_bh(bh_check); > last_check_time = jiffies; > } > > -- > 2.31.1 >
On 2021/10/7 20:44, Jan Kara wrote: > On Sat 11-09-21 17:00:57, Ye Bin wrote: >> As call read_mmp_block pass bh_check which value is NULL, then call >> sb_getblk to get buffer_head. But mmp_block's buffer_head is already exist >> which also is uptodate. Lead to compare the same data. >> >> Signed-off-by: Ye Bin <yebin10@huawei.com> > This looks good, except that read_mmp_block() also releases bh it is passed > in case of error. So it can free buffer head which is still referenced from > EXT4_SB(sb)->s_mmp_bh and cause use-after-free issues. > > I guess I would just get rid of sb_getblk() in read_mmp_block() and always > expect valid bh passed. The only place that passes NULL bh after this > patch is one case in ext4_multi_mount_protect() and that can call > sb_getblk() on its own. That way we can also simplify read_mmp_block() > prototype to: > > static int read_mmp_block(struct super_block *sb, struct buffer_head *bh); > > Honza > Yeah, I will refactor 'read_mmp_block'. >> --- >> fs/ext4/mmp.c | 17 ++++++----------- >> 1 file changed, 6 insertions(+), 11 deletions(-) >> >> diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c >> index 4433fe7e9e86..007bde3c12b8 100644 >> --- a/fs/ext4/mmp.c >> +++ b/fs/ext4/mmp.c >> @@ -213,10 +213,7 @@ static int kmmpd(void *data) >> * we need to check if the MMP block is as we write it. >> */ >> if (jiffies - last_check_time > mmp_check_interval * HZ) { >> - struct buffer_head *bh_check = NULL; >> - struct mmp_struct *mmp_check; >> - >> - retval = read_mmp_block(sb, &bh_check, mmp_block); >> + retval = read_mmp_block(sb, &bh, mmp_block); >> if (retval) { >> ext4_error_err(sb, -retval, >> "error reading MMP data: %d", >> @@ -224,20 +221,18 @@ static int kmmpd(void *data) >> goto wait_to_exit; >> } >> >> - mmp_check = (struct mmp_struct *)(bh_check->b_data); >> - if (seq != mmp_check->mmp_seq || >> - memcmp(nodename, mmp_check->mmp_nodename, >> - sizeof(mmp->mmp_nodename))) { >> - dump_mmp_msg(sb, mmp_check, >> + mmp = (struct mmp_struct *)(bh->b_data); >> + if (seq != le32_to_cpu(mmp->mmp_seq) || >> + memcmp(nodename, mmp->mmp_nodename, >> + sizeof(nodename))) { >> + dump_mmp_msg(sb, mmp, >> "Error while updating MMP info. " >> "The filesystem seems to have been" >> " multiply mounted."); >> ext4_error_err(sb, EBUSY, "abort"); >> - put_bh(bh_check); >> retval = -EBUSY; >> goto wait_to_exit; >> } >> - put_bh(bh_check); >> last_check_time = jiffies; >> } >> >> -- >> 2.31.1 >>
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c index 4433fe7e9e86..007bde3c12b8 100644 --- a/fs/ext4/mmp.c +++ b/fs/ext4/mmp.c @@ -213,10 +213,7 @@ static int kmmpd(void *data) * we need to check if the MMP block is as we write it. */ if (jiffies - last_check_time > mmp_check_interval * HZ) { - struct buffer_head *bh_check = NULL; - struct mmp_struct *mmp_check; - - retval = read_mmp_block(sb, &bh_check, mmp_block); + retval = read_mmp_block(sb, &bh, mmp_block); if (retval) { ext4_error_err(sb, -retval, "error reading MMP data: %d", @@ -224,20 +221,18 @@ static int kmmpd(void *data) goto wait_to_exit; } - mmp_check = (struct mmp_struct *)(bh_check->b_data); - if (seq != mmp_check->mmp_seq || - memcmp(nodename, mmp_check->mmp_nodename, - sizeof(mmp->mmp_nodename))) { - dump_mmp_msg(sb, mmp_check, + mmp = (struct mmp_struct *)(bh->b_data); + if (seq != le32_to_cpu(mmp->mmp_seq) || + memcmp(nodename, mmp->mmp_nodename, + sizeof(nodename))) { + dump_mmp_msg(sb, mmp, "Error while updating MMP info. " "The filesystem seems to have been" " multiply mounted."); ext4_error_err(sb, EBUSY, "abort"); - put_bh(bh_check); retval = -EBUSY; goto wait_to_exit; } - put_bh(bh_check); last_check_time = jiffies; }
As call read_mmp_block pass bh_check which value is NULL, then call sb_getblk to get buffer_head. But mmp_block's buffer_head is already exist which also is uptodate. Lead to compare the same data. Signed-off-by: Ye Bin <yebin10@huawei.com> --- fs/ext4/mmp.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)