* [PATCH] f2fs: compress: fix to avoid NULL pointer dereference
@ 2020-01-17 7:59 Chao Yu
0 siblings, 0 replies; only message in thread
From: Chao Yu @ 2020-01-17 7:59 UTC (permalink / raw)
To: jaegeuk; +Cc: linux-f2fs-devel, linux-kernel, chao, Chao Yu
If cluster has only one compressed page, race condition as below will
trigger NULL pointer dereference:
- f2fs_write_compressed_pages
- cic->rpages[0] = cc->rpages[0];
- f2fs_outplace_write_data
- f2fs_compress_write_end_io
- WARN_ON(!cic->rpages[1]);
- cic->rpages[1] = cc->rpages[1];
Signed-off-by: Chao Yu <yuchao0@huawei.com>
---
fs/f2fs/compress.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 45a6f20ceb3e..d8a64be90a50 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -837,12 +837,15 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
set_cluster_writeback(cc);
+ for (i = 0; i < cc->cluster_size; i++)
+ cic->rpages[i] = cc->rpages[i];
+
for (i = 0; i < cc->cluster_size; i++, dn.ofs_in_node++) {
block_t blkaddr;
blkaddr = datablock_addr(dn.inode, dn.node_page,
dn.ofs_in_node);
- fio.page = cic->rpages[i] = cc->rpages[i];
+ fio.page = cic->rpages[i];
fio.old_blkaddr = blkaddr;
/* cluster header */
--
2.18.0.rc1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2020-01-17 7:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-17 7:59 [PATCH] f2fs: compress: fix to avoid NULL pointer dereference Chao Yu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).