* [PATCH] f2fs: fix to avoid race during access gc_thread pointer
@ 2018-05-08 3:39 ` Chao Yu
0 siblings, 0 replies; 3+ messages in thread
From: Chao Yu @ 2018-05-08 3:39 UTC (permalink / raw)
To: jaegeuk; +Cc: linux-f2fs-devel, linux-kernel, chao, Chao Yu
Thread A Thread B
- f2fs_remount
- stop_gc_thread
- f2fs_sbi_store
sbi->gc_thread = NULL;
access sbi->gc_thread->gc_*
Previously, we allocate memory for sbi->gc_thread based on background
gc thread mount option, the memory can be released if we turn off
that mount option, but still there are several places access gc_thread
pointer without considering race condition, result in NULL point
dereference.
In order to fix this issue, use sb->s_umount to exclude those operations.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
---
fs/f2fs/sysfs.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index f3c3fb4cbb0d..0aec4db7fa02 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -179,6 +179,7 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
unsigned long t;
unsigned int *ui;
ssize_t ret;
+ bool gc_entry = (a->struct_type == GC_THREAD);
ptr = __struct_ptr(sbi, a->struct_type);
if (!ptr)
@@ -277,8 +278,14 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
return count;
}
+ if (gc_entry)
+ down_read(&sbi->sb->s_umount);
+
*ui = t;
+ if (gc_entry)
+ up_read(&sbi->sb->s_umount);
+
if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
f2fs_reset_iostat(sbi);
return count;
--
2.17.0.391.g1f1cddd558b5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] f2fs: fix to avoid race during access gc_thread pointer
@ 2018-05-08 3:39 ` Chao Yu
0 siblings, 0 replies; 3+ messages in thread
From: Chao Yu @ 2018-05-08 3:39 UTC (permalink / raw)
To: jaegeuk; +Cc: linux-f2fs-devel, linux-kernel, chao, Chao Yu
Thread A Thread B
- f2fs_remount
- stop_gc_thread
- f2fs_sbi_store
sbi->gc_thread = NULL;
access sbi->gc_thread->gc_*
Previously, we allocate memory for sbi->gc_thread based on background
gc thread mount option, the memory can be released if we turn off
that mount option, but still there are several places access gc_thread
pointer without considering race condition, result in NULL point
dereference.
In order to fix this issue, use sb->s_umount to exclude those operations.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
---
fs/f2fs/sysfs.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index f3c3fb4cbb0d..0aec4db7fa02 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -179,6 +179,7 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
unsigned long t;
unsigned int *ui;
ssize_t ret;
+ bool gc_entry = (a->struct_type == GC_THREAD);
ptr = __struct_ptr(sbi, a->struct_type);
if (!ptr)
@@ -277,8 +278,14 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
return count;
}
+ if (gc_entry)
+ down_read(&sbi->sb->s_umount);
+
*ui = t;
+ if (gc_entry)
+ up_read(&sbi->sb->s_umount);
+
if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
f2fs_reset_iostat(sbi);
return count;
--
2.17.0.391.g1f1cddd558b5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] f2fs: fix to avoid race during access gc_thread pointer
2018-05-08 3:39 ` Chao Yu
(?)
@ 2018-05-08 3:54 ` Jaegeuk Kim
-1 siblings, 0 replies; 3+ messages in thread
From: Jaegeuk Kim @ 2018-05-08 3:54 UTC (permalink / raw)
To: Chao Yu; +Cc: linux-f2fs-devel, linux-kernel, chao
On 05/08, Chao Yu wrote:
> Thread A Thread B
> - f2fs_remount
> - stop_gc_thread
> - f2fs_sbi_store
> sbi->gc_thread = NULL;
> access sbi->gc_thread->gc_*
>
> Previously, we allocate memory for sbi->gc_thread based on background
> gc thread mount option, the memory can be released if we turn off
> that mount option, but still there are several places access gc_thread
> pointer without considering race condition, result in NULL point
> dereference.
>
> In order to fix this issue, use sb->s_umount to exclude those operations.
>
> Signed-off-by: Chao Yu <yuchao0@huawei.com>
> ---
> fs/f2fs/sysfs.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
> index f3c3fb4cbb0d..0aec4db7fa02 100644
> --- a/fs/f2fs/sysfs.c
> +++ b/fs/f2fs/sysfs.c
> @@ -179,6 +179,7 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
> unsigned long t;
> unsigned int *ui;
> ssize_t ret;
> + bool gc_entry = (a->struct_type == GC_THREAD);
>
> ptr = __struct_ptr(sbi, a->struct_type);
We need to cover __struct_ptr() here.
> if (!ptr)
> @@ -277,8 +278,14 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
> return count;
> }
>
> + if (gc_entry)
> + down_read(&sbi->sb->s_umount);
> +
> *ui = t;
>
> + if (gc_entry)
> + up_read(&sbi->sb->s_umount);
> +
> if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
> f2fs_reset_iostat(sbi);
> return count;
> --
> 2.17.0.391.g1f1cddd558b5
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-05-08 3:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-08 3:39 [PATCH] f2fs: fix to avoid race during access gc_thread pointer Chao Yu
2018-05-08 3:39 ` Chao Yu
2018-05-08 3:54 ` Jaegeuk Kim
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.