FROMLIST: f2fs: fix use-after-free when accessing bio->bi_crypt_context
There could be a potential race between these two paths below, leading to use-after-free when accessing bio->bi_crypt_context. f2fs_write_cache_pages ->f2fs_do_write_data_page on page#1 ->f2fs_inplace_write_data ->f2fs_merge_page_bio ->add_bio_entry ->f2fs_do_write_data_page on page#2 ->f2fs_inplace_write_data ->f2fs_merge_page_bio ->f2fs_crypt_mergeable_bio ->fscrypt_mergeable_bio f2fs_write_begin on page#1 ->f2fs_wait_on_page_writeback ->f2fs_submit_merged_ipu_write ->__submit_bio The bio gets completed, calling bio_endio ->bio_uninit ->bio_crypt_free_ctx ->use-after-free issue Fix this by moving f2fs_crypt_mergeable_bio() check within add_ipu_page() so that it's done under bio_list_lock to prevent the above race. Bug: 137270441 Link: https://lore.kernel.org/linux-f2fs-devel/1592193588-21701-1-git-send-email-stummala@codeaurora.org/ Fixes: fb710731b64b ("f2fs: add inline encryption support") Signed-off-by:Sahitya Tummala <stummala@codeaurora.org> Signed-off-by:
Satya Tangirala <satyat@google.com> Change-Id: I1bd2cfa430423ba2a8d7c1da505322ded097cd9e
Loading
Please register or sign in to comment