| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263 |
- From bf9fb25f3265605572f04e5c7836bb83ee345236 Mon Sep 17 00:00:00 2001
- From: Chao Yu <[email protected]>
- Date: Fri, 30 Dec 2022 23:43:32 +0800
- Subject: [PATCH] f2fs: fix to avoid NULL pointer dereference in
- f2fs_issue_flush()
- commit b3d83066cbebc76dbac8a5fca931f64b4c6fff34 upstream.
- With below two cases, it will cause NULL pointer dereference when
- accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
- a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
- release SM_I(sbi)->fcc_info,
- - mount -o noflush_merge /dev/vda /mnt/f2fs
- - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails
- - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
- b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below
- testcase,
- - mount -o ro /dev/vda /mnt/f2fs
- - mount -o rw,remount /dev/vda /mnt/f2fs
- - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
- In order to fix this issue, let change as below:
- - fix error path handling in f2fs_create_flush_cmd_control().
- - allocate SM_I(sbi)->fcc_info even if readonly is on.
- Signed-off-by: Chao Yu <[email protected]>
- Signed-off-by: Jaegeuk Kim <[email protected]>
- ---
- fs/f2fs/segment.c | 12 ++++--------
- 1 file changed, 4 insertions(+), 8 deletions(-)
- --- a/fs/f2fs/segment.c
- +++ b/fs/f2fs/segment.c
- @@ -665,9 +665,7 @@ init_thread:
- "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
- if (IS_ERR(fcc->f2fs_issue_flush)) {
- err = PTR_ERR(fcc->f2fs_issue_flush);
- - kfree(fcc);
- - SM_I(sbi)->fcc_info = NULL;
- - return err;
- + fcc->f2fs_issue_flush = NULL;
- }
-
- return err;
- @@ -5064,11 +5062,9 @@ int f2fs_build_segment_manager(struct f2
-
- init_f2fs_rwsem(&sm_info->curseg_lock);
-
- - if (!f2fs_readonly(sbi->sb)) {
- - err = f2fs_create_flush_cmd_control(sbi);
- - if (err)
- - return err;
- - }
- + err = f2fs_create_flush_cmd_control(sbi);
- + if (err)
- + return err;
-
- err = create_discard_cmd_control(sbi);
- if (err)
|
