Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 973fc2b3 authored by Coly Li's avatar Coly Li Committed by Greg Kroah-Hartman
Browse files

bcache: fix stack corruption by PRECEDING_KEY() 



commit 31b90956b124240aa8c63250243ae1a53585c5e2 upstream.

Recently people report bcache code compiled with gcc9 is broken, one of
the buggy behavior I observe is that two adjacent 4KB I/Os should merge
into one but they don't. Finally it turns out to be a stack corruption
caused by macro PRECEDING_KEY().

See how PRECEDING_KEY() is defined in bset.h,
437 #define PRECEDING_KEY(_k)                                       \
438 ({                                                              \
439         struct bkey *_ret = NULL;                               \
440                                                                 \
441         if (KEY_INODE(_k) || KEY_OFFSET(_k)) {                  \
442                 _ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0);  \
443                                                                 \
444                 if (!_ret->low)                                 \
445                         _ret->high--;                           \
446                 _ret->low--;                                    \
447         }                                                       \
448                                                                 \
449         _ret;                                                   \
450 })

At line 442, _ret points to address of a on-stack variable combined by
KEY(), the life range of this on-stack variable is in line 442-446,
once _ret is returned to bch_btree_insert_key(), the returned address
points to an invalid stack address and this address is overwritten in
the following called bch_btree_iter_init(). Then argument 'search' of
bch_btree_iter_init() points to some address inside stackframe of
bch_btree_iter_init(), exact address depends on how the compiler
allocates stack space. Now the stack is corrupted.

Fixes: 0eacac22 ("bcache: PRECEDING_KEY()")
Signed-off-by: default avatarColy Li <colyli@suse.de>
Reviewed-by: default avatarRolf Fokkens <rolf@rolffokkens.nl>
Reviewed-by: default avatarPierre JUHEN <pierre.juhen@orange.fr>
Tested-by: default avatarShenghui Wang <shhuiw@foxmail.com>
Tested-by: default avatarPierre JUHEN <pierre.juhen@orange.fr>
Cc: Kent Overstreet <kent.overstreet@gmail.com>
Cc: Nix <nix@esperi.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent da3b915a

drivers/md/bcache/bset.c

+13 −3
Original line number Original line Diff line number Diff line
@@ -887,12 +887,22 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, 
	struct bset *i = bset_tree_last(b)->data;

	struct bset *i = bset_tree_last(b)->data;

	struct bkey *m, *prev = NULL;

	struct bkey *m, *prev = NULL;

	struct btree_iter iter;

	struct btree_iter iter;

	struct bkey preceding_key_on_stack = ZERO_KEY;

	struct bkey *preceding_key_p = &preceding_key_on_stack;





	BUG_ON(b->ops->is_extents && !KEY_SIZE(k));

	BUG_ON(b->ops->is_extents && !KEY_SIZE(k));





	m = bch_btree_iter_init(b, &iter, b->ops->is_extents

	/*

				? PRECEDING_KEY(&START_KEY(k))

	 * If k has preceding key, preceding_key_p will be set to address

				: PRECEDING_KEY(k));

	 *  of k's preceding key; otherwise preceding_key_p will be set

	 * to NULL inside preceding_key().

	 */

	if (b->ops->is_extents)

		preceding_key(&START_KEY(k), &preceding_key_p);

	else

		preceding_key(k, &preceding_key_p);



	m = bch_btree_iter_init(b, &iter, preceding_key_p);





	if (b->ops->insert_fixup(b, k, &iter, replace_key))

	if (b->ops->insert_fixup(b, k, &iter, replace_key))

		return status;

		return status;

drivers/md/bcache/bset.h

+20 −14
Original line number Original line Diff line number Diff line
@@ -434,20 +434,26 @@ static inline bool bch_cut_back(const struct bkey *where, struct bkey *k) 
	return __bch_cut_back(where, k);

	return __bch_cut_back(where, k);

}

}





#define PRECEDING_KEY(_k)					\

/*

({								\

 * Pointer '*preceding_key_p' points to a memory object to store preceding

	struct bkey *_ret = NULL;				\

 * key of k. If the preceding key does not exist, set '*preceding_key_p' to

								\

 * NULL. So the caller of preceding_key() needs to take care of memory

	if (KEY_INODE(_k) || KEY_OFFSET(_k)) {			\

 * which '*preceding_key_p' pointed to before calling preceding_key().

		_ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0);	\

 * Currently the only caller of preceding_key() is bch_btree_insert_key(),

								\

 * and it points to an on-stack variable, so the memory release is handled

		if (!_ret->low)					\

 * by stackframe itself.

			_ret->high--;				\

 */

		_ret->low--;					\

static inline void preceding_key(struct bkey *k, struct bkey **preceding_key_p)

	}							\

{

								\

	if (KEY_INODE(k) || KEY_OFFSET(k)) {

	_ret;							\

		(**preceding_key_p) = KEY(KEY_INODE(k), KEY_OFFSET(k), 0);

})

		if (!(*preceding_key_p)->low)

			(*preceding_key_p)->high--;

		(*preceding_key_p)->low--;

	} else {

		(*preceding_key_p) = NULL;

	}

}





static inline bool bch_ptr_invalid(struct btree_keys *b, const struct bkey *k)

static inline bool bch_ptr_invalid(struct btree_keys *b, const struct bkey *k)

{

{