btrfs use after free

btrfs-use-after-free.patch

@@ -0,0 +1,71 @@
+On Tue, Apr 03, 2012 at 12:50:55PM -0400, Dave Jones wrote:
+ > On Tue, Apr 03, 2012 at 06:33:43PM +0200, David Sterba wrote:
+ >  > On Tue, Apr 03, 2012 at 12:20:23PM -0400, Dave Jones wrote:
+ >  > > I see a lot of these ..
+ >  > > 
+ >  > > btrfs: __btrfs_end_transaction -EIO abored=1802201963 (no super error)
+ >  > 
+ >  > 1802201963 == 0x6b6b6b6b
+ >  > 
+ >  > #define POISON_FREE     0x6b    /* for use-after-free poisoning */
+ >  > 
+ >  > hmm
+ > 
+ > wait, what...
+ > 
+ >  535         memset(trans, 0, sizeof(*trans));
+ >  536         kmem_cache_free(btrfs_trans_handle_cachep, trans);
+ >  537 
+ >  538         if (throttle)
+ >  539                 btrfs_run_delayed_iputs(root);
+ >  540 
+ >  541         if (trans->aborted ||
+ >  542             root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+ >  543                 return -EIO;
+ >  544         }
+ > 
+ > that looks like a pretty clear use-after-free.
+
+Ok, trying this..
+
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 8da29e8..11b77a5 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
+ 	struct btrfs_transaction *cur_trans = trans->transaction;
+ 	struct btrfs_fs_info *info = root->fs_info;
+ 	int count = 0;
++	int err = 0;
+ 
+ 	if (--trans->use_count) {
+ 		trans->block_rsv = trans->orig_rsv;
+@@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
+ 
+ 	if (current->journal_info == trans)
+ 		current->journal_info = NULL;
+-	memset(trans, 0, sizeof(*trans));
+-	kmem_cache_free(btrfs_trans_handle_cachep, trans);
+ 
+ 	if (throttle)
+ 		btrfs_run_delayed_iputs(root);
+ 
+ 	if (trans->aborted ||
+ 	    root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+-		return -EIO;
++		err = -EIO;
+ 	}
+ 
+-	return 0;
++	memset(trans, 0, sizeof(*trans));
++	kmem_cache_free(btrfs_trans_handle_cachep, trans);
++	return err;
+ }
+ 
+ int btrfs_end_transaction(struct btrfs_trans_handle *trans,
+--
+To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+Please read the FAQ at  http://www.tux.org/lkml/

kernel.spec

@@ -702,6 +702,7 @@ Patch2900: linux-2.6-v4l-dvb-update.patch
 Patch2901: linux-2.6-v4l-dvb-experimental.patch
 
 # fs fixes
+Patch4000: btrfs-use-after-free.patch
 
 # NFSv4
 
@@ -1313,6 +1314,7 @@ ApplyPatch arm-tegra-nvec-kconfig.patch
 # xfs
 
 # btrfs
+ApplyPatch btrfs-use-after-free.patch
 
 
 # eCryptfs
@@ -2285,6 +2287,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Tue Apr 03 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc1.git1.2
+- BTRFS use after free patch
+
 * Tue Apr 03 2012 Justin M. Forbes <jforbes@redhat.com> - 3.4.0-0.rc1.git1.2
 - Reenable debugging options.