| Message ID | 20221230154332.5082-1-chao@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | b3d83066cbebc76dbac8a5fca931f64b4c6fff34 |
| Headers | show |
| Series | [f2fs-dev] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() | expand |
Hello: This patch was applied to jaegeuk/f2fs.git (dev) by Jaegeuk Kim <jaegeuk@kernel.org>: On Fri, 30 Dec 2022 23:43:32 +0800 you wrote: > With below two cases, it will cause NULL pointer dereference when > accessing SM_I(sbi)->fcc_info in f2fs_issue_flush(). > > a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will > release SM_I(sbi)->fcc_info, > > - mount -o noflush_merge /dev/vda /mnt/f2fs > - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails > - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync > > [...] Here is the summary with links: - [f2fs-dev] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() https://git.kernel.org/jaegeux/f2fs/c/b3d83066cbeb You are awesome, thank you!
<patchwork-bot+f2fs@kernel.org> 于2023年1月4日周三 01:04写道： > > Hello: > > This patch was applied to jaegeuk/f2fs.git (dev) > by Jaegeuk Kim <jaegeuk@kernel.org>: > > On Fri, 30 Dec 2022 23:43:32 +0800 you wrote: > > With below two cases, it will cause NULL pointer dereference when > > accessing SM_I(sbi)->fcc_info in f2fs_issue_flush(). > > > > a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will > > release SM_I(sbi)->fcc_info, > > > > - mount -o noflush_merge /dev/vda /mnt/f2fs > > - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails > > - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync > > > > [...] > > Here is the summary with links: > - [f2fs-dev] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() > https://git.kernel.org/jaegeux/f2fs/c/b3d83066cbeb > Hi jeageuk, There is a character error in patchwork configuration, :). :s/jaegeux/jeageuk/g > You are awesome, thank you! > -- > Deet-doot-dot, I am a bot. > https://korg.docs.kernel.org/patchwork/pwbot.html > > > > > _______________________________________________ > Linux-f2fs-devel mailing list > Linux-f2fs-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 2646575f43de..16f60c646cc2 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -663,8 +663,7 @@ int f2fs_create_flush_cmd_control(struct f2fs_sb_info *sbi) if (IS_ERR(fcc->f2fs_issue_flush)) { int err = PTR_ERR(fcc->f2fs_issue_flush); - kfree(fcc); - SM_I(sbi)->fcc_info = NULL; + fcc->f2fs_issue_flush = NULL; return err; } @@ -5137,11 +5136,9 @@ int f2fs_build_segment_manager(struct f2fs_sb_info *sbi) init_f2fs_rwsem(&sm_info->curseg_lock); - if (!f2fs_readonly(sbi->sb)) { - err = f2fs_create_flush_cmd_control(sbi); - if (err) - return err; - } + err = f2fs_create_flush_cmd_control(sbi); + if (err) + return err; err = create_discard_cmd_control(sbi); if (err)
With below two cases, it will cause NULL pointer dereference when accessing SM_I(sbi)->fcc_info in f2fs_issue_flush(). a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will release SM_I(sbi)->fcc_info, - mount -o noflush_merge /dev/vda /mnt/f2fs - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below testcase, - mount -o ro /dev/vda /mnt/f2fs - mount -o rw,remount /dev/vda /mnt/f2fs - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync In order to fix this issue, let change as below: - fix error path handling in f2fs_create_flush_cmd_control(). - allocate SM_I(sbi)->fcc_info even if readonly is on. Signed-off-by: Chao Yu <chao@kernel.org> --- fs/f2fs/segment.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)