* [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
@ 2018-12-15 17:21 Loic
2018-12-18 16:22 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Loic @ 2018-12-15 17:21 UTC (permalink / raw)
To: stable; +Cc: heyunlei, jaegeuk
Hello,
Please picked up this patch for linux 4.4.
This fixes CVE-2017-18241. This has been fixed in linux 4.9.144.
Thank.
[ Upstream commit d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 ]
From: Yunlei He <heyunlei@huawei.com>
Date: Thu, 1 Jun 2017 16:43:51 +0800
Subject: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:
if (!test_opt(sbi, FLUSH_MERGE)) {
ret = submit_flush_wait(sbi);
atomic_inc(&fcc->issued_flush); -> Here, fcc illegal
return ret;
}
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[bwh: Backported to 4.9: adjust context]
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -488,6 +488,9 @@ int create_flush_cmd_control(struct f2fs
init_waitqueue_head(&fcc->flush_wait_queue);
init_llist_head(&fcc->issue_list);
SM_I(sbi)->cmd_control_info = fcc;
+ if (!test_opt(sbi, FLUSH_MERGE))
+ return err;
+
fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
if (IS_ERR(fcc->f2fs_issue_flush)) {
@@ -2534,7 +2537,7 @@ int build_segment_manager(struct f2fs_sb
INIT_LIST_HEAD(&sm_info->sit_entry_set);
- if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
+ if (!f2fs_readonly(sbi->sb)) {
err = create_flush_cmd_control(sbi);
if (err)
return err;
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
2018-12-15 17:21 [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control Loic
@ 2018-12-18 16:22 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2018-12-18 16:22 UTC (permalink / raw)
To: Loic; +Cc: stable, heyunlei, jaegeuk
On Sat, Dec 15, 2018 at 06:21:54PM +0100, Loic wrote:
> Hello,
>
> Please picked up this patch for linux 4.4.
> This fixes CVE-2017-18241. This has been fixed in linux 4.9.144.
>
> Thank.
>
> [ Upstream commit d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 ]
>
> From: Yunlei He <heyunlei@huawei.com>
> Date: Thu, 1 Jun 2017 16:43:51 +0800
> Subject: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
>
> Mount fs with option noflush_merge, boot failed for illegal address
> fcc in function f2fs_issue_flush:
>
> if (!test_opt(sbi, FLUSH_MERGE)) {
> ret = submit_flush_wait(sbi);
> atomic_inc(&fcc->issued_flush); -> Here, fcc illegal
> return ret;
> }
>
> Signed-off-by: Yunlei He <heyunlei@huawei.com>
> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
> [bwh: Backported to 4.9: adjust context]
> ---
> fs/f2fs/segment.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
@ 2017-06-01 8:43 Yunlei He
0 siblings, 0 replies; 3+ messages in thread
From: Yunlei He @ 2017-06-01 8:43 UTC (permalink / raw)
To: jaegeuk, yuchao0, linux-f2fs-devel
Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:
if (!test_opt(sbi, FLUSH_MERGE)) {
ret = submit_flush_wait(sbi);
atomic_inc(&fcc->issued_flush); -> Here, fcc illegal
return ret;
}
Signed-off-by: Yunlei He <heyunlei@huawei.com>
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index a8f4c81..029b5ea 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -566,6 +566,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
init_waitqueue_head(&fcc->flush_wait_queue);
init_llist_head(&fcc->issue_list);
SM_I(sbi)->fcc_info = fcc;
+ if (!test_opt(sbi, FLUSH_MERGE))
+ return err;
+
init_thread:
fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
@@ -3239,7 +3242,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
INIT_LIST_HEAD(&sm_info->sit_entry_set);
- if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
+ if (!f2fs_readonly(sbi->sb)) {
err = create_flush_cmd_control(sbi);
if (err)
return err;
--
1.9.1
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-12-18 16:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-15 17:21 [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control Loic
2018-12-18 16:22 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2017-06-01 8:43 Yunlei He
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.