btrfs: fix use-after-free waiting for encoded read endios

Fix a use-after-free in the I/O completion path for encoded reads by
using a completion instead of a wait_queue for synchronizing the
destruction of 'struct btrfs_encoded_read_private'.

Fixes: 1881fba89bd5 ("btrfs: add BTRFS_IOC_ENCODED_READ ioctl")
CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 94c8809e817057eed7b6a9362c8cd481ca9cea17..6baa0269a85b0937cc934c2c37c719dcf2e9bc04 100644 (file)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9078,9 +9078,9 @@ out:
 }
 
 struct btrfs_encoded_read_private {
-       wait_queue_head_t wait;
+       struct completion done;
        void *uring_ctx;
-       atomic_t pending;
+       refcount_t pending_refs;
        blk_status_t status;
 };
 
@@ -9099,14 +9099,14 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio)
                 */
                WRITE_ONCE(priv->status, bbio->bio.bi_status);
        }
-       if (atomic_dec_and_test(&priv->pending)) {
+       if (refcount_dec_and_test(&priv->pending_refs)) {
                int err = blk_status_to_errno(READ_ONCE(priv->status));
 
                if (priv->uring_ctx) {
                        btrfs_uring_read_extent_endio(priv->uring_ctx, err);
                        kfree(priv);
                } else {
-                       wake_up(&priv->wait);
+                       complete(&priv->done);
                }
        }
        bio_put(&bbio->bio);
@@ -9126,8 +9126,8 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
        if (!priv)
                return -ENOMEM;
 
-       init_waitqueue_head(&priv->wait);
-       atomic_set(&priv->pending, 1);
+       init_completion(&priv->done);
+       refcount_set(&priv->pending_refs, 1);
        priv->status = 0;
        priv->uring_ctx = uring_ctx;
 
@@ -9140,7 +9140,7 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
                size_t bytes = min_t(u64, disk_io_size, PAGE_SIZE);
 
                if (bio_add_page(&bbio->bio, pages[i], bytes, 0) < bytes) {
-                       atomic_inc(&priv->pending);
+                       refcount_inc(&priv->pending_refs);
                        btrfs_submit_bbio(bbio, 0);
 
                        bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
@@ -9155,11 +9155,11 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
                disk_io_size -= bytes;
        } while (disk_io_size);
 
-       atomic_inc(&priv->pending);
+       refcount_inc(&priv->pending_refs);
        btrfs_submit_bbio(bbio, 0);
 
        if (uring_ctx) {
-               if (atomic_dec_return(&priv->pending) == 0) {
+               if (refcount_dec_and_test(&priv->pending_refs)) {
                        ret = blk_status_to_errno(READ_ONCE(priv->status));
                        btrfs_uring_read_extent_endio(uring_ctx, ret);
                        kfree(priv);
@@ -9168,8 +9168,8 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 
                return -EIOCBQUEUED;
        } else {
-               if (atomic_dec_return(&priv->pending) != 0)
-                       io_wait_event(priv->wait, !atomic_read(&priv->pending));
+               if (!refcount_dec_and_test(&priv->pending_refs))
+                       wait_for_completion_io(&priv->done);
                /* See btrfs_encoded_read_endio() for ordering. */
                ret = blk_status_to_errno(READ_ONCE(priv->status));
                kfree(priv);