64 lines
1.9 KiB
Diff
64 lines
1.9 KiB
Diff
From bf9fb25f3265605572f04e5c7836bb83ee345236 Mon Sep 17 00:00:00 2001
|
|
From: Chao Yu <chao@kernel.org>
|
|
Date: Fri, 30 Dec 2022 23:43:32 +0800
|
|
Subject: [PATCH] f2fs: fix to avoid NULL pointer dereference in
|
|
f2fs_issue_flush()
|
|
|
|
commit b3d83066cbebc76dbac8a5fca931f64b4c6fff34 upstream.
|
|
|
|
With below two cases, it will cause NULL pointer dereference when
|
|
accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
|
|
|
|
a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
|
|
release SM_I(sbi)->fcc_info,
|
|
|
|
- mount -o noflush_merge /dev/vda /mnt/f2fs
|
|
- mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails
|
|
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
|
|
|
|
b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below
|
|
testcase,
|
|
|
|
- mount -o ro /dev/vda /mnt/f2fs
|
|
- mount -o rw,remount /dev/vda /mnt/f2fs
|
|
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
|
|
|
|
In order to fix this issue, let change as below:
|
|
- fix error path handling in f2fs_create_flush_cmd_control().
|
|
- allocate SM_I(sbi)->fcc_info even if readonly is on.
|
|
|
|
Signed-off-by: Chao Yu <chao@kernel.org>
|
|
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
---
|
|
fs/f2fs/segment.c | 12 ++++--------
|
|
1 file changed, 4 insertions(+), 8 deletions(-)
|
|
|
|
--- a/fs/f2fs/segment.c
|
|
+++ b/fs/f2fs/segment.c
|
|
@@ -665,9 +665,7 @@ init_thread:
|
|
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
|
|
if (IS_ERR(fcc->f2fs_issue_flush)) {
|
|
err = PTR_ERR(fcc->f2fs_issue_flush);
|
|
- kfree(fcc);
|
|
- SM_I(sbi)->fcc_info = NULL;
|
|
- return err;
|
|
+ fcc->f2fs_issue_flush = NULL;
|
|
}
|
|
|
|
return err;
|
|
@@ -5064,11 +5062,9 @@ int f2fs_build_segment_manager(struct f2
|
|
|
|
init_f2fs_rwsem(&sm_info->curseg_lock);
|
|
|
|
- if (!f2fs_readonly(sbi->sb)) {
|
|
- err = f2fs_create_flush_cmd_control(sbi);
|
|
- if (err)
|
|
- return err;
|
|
- }
|
|
+ err = f2fs_create_flush_cmd_control(sbi);
|
|
+ if (err)
|
|
+ return err;
|
|
|
|
err = create_discard_cmd_control(sbi);
|
|
if (err)
|