• Gao Xiang's avatar
    staging: erofs: compressed_pages should not be accessed again after freed · af692e11
    Gao Xiang authored
    This patch resolves the following page use-after-free issue,
    z_erofs_vle_unzip:
        ...
        for (i = 0; i < nr_pages; ++i) {
            ...
            z_erofs_onlinepage_endio(page);  (1)
        }
    
        for (i = 0; i < clusterpages; ++i) {
            page = compressed_pages[i];
    
            if (page->mapping == mngda)      (2)
                continue;
            /* recycle all individual staging pages */
            (void)z_erofs_gather_if_stagingpage(page_pool, page); (3)
            WRITE_ONCE(compressed_pages[i], NULL);
        }
        ...
    
    After (1) is executed, page is freed and could be then reused, if
    compressed_pages is scanned after that, it could fall info (2) or
    (3) by mistake and that could finally be in a mess.
    
    This patch aims to solve the above issue only with little changes
    as much as possible in order to make the fix backport easier.
    
    Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
    Cc: <stable@vger.kernel.org> # 4.19+
    Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
    Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    af692e11
unzip_vle.c 46.3 KB