From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [f2fs-dev] [PATCH AUTOSEL 5.6 014/129] f2fs: fix to avoid use-after-free in f2fs_write_multi_pages()
Date: Wed, 15 Apr 2020 07:32:49 -0400 [thread overview]
Message-ID: <20200415113445.11881-14-sashal@kernel.org> (raw)
In-Reply-To: <20200415113445.11881-1-sashal@kernel.org>
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 95978caa138948054e06d00bfc3432b518699f1b ]
In compress cluster, if physical block number is less than logic
page number, race condition will cause use-after-free issue as
described below:
- f2fs_write_compressed_pages
- fio.page = cic->rpages[0];
- f2fs_outplace_write_data
- f2fs_compress_write_end_io
- kfree(cic->rpages);
- kfree(cic);
- fio.page = cic->rpages[1];
f2fs_write_multi_pages+0xfd0/0x1a98
f2fs_write_data_pages+0x74c/0xb5c
do_writepages+0x64/0x108
__writeback_single_inode+0xdc/0x4b8
writeback_sb_inodes+0x4d0/0xa68
__writeback_inodes_wb+0x88/0x178
wb_writeback+0x1f0/0x424
wb_workfn+0x2f4/0x574
process_one_work+0x210/0x48c
worker_thread+0x2e8/0x44c
kthread+0x110/0x120
ret_from_fork+0x10/0x18
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index c847523ab4a2e..927db1205bd81 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -845,7 +845,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
blkaddr = datablock_addr(dn.inode, dn.node_page,
dn.ofs_in_node);
- fio.page = cic->rpages[i];
+ fio.page = cc->rpages[i];
fio.old_blkaddr = blkaddr;
/* cluster header */
--
2.20.1
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2020-04-15 11:35 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200415113445.11881-1-sashal@kernel.org>
2020-04-15 11:32 ` [f2fs-dev] [PATCH AUTOSEL 5.6 009/129] f2fs: fix to avoid potential deadlock Sasha Levin
2020-04-15 11:32 ` [f2fs-dev] [PATCH AUTOSEL 5.6 010/129] f2fs: fix the panic in do_checkpoint() Sasha Levin
2020-04-15 11:32 ` [f2fs-dev] [PATCH AUTOSEL 5.6 013/129] f2fs: fix wrong check on F2FS_IOC_FSSETXATTR Sasha Levin
2020-04-15 11:32 ` Sasha Levin [this message]
2020-04-15 11:33 ` [f2fs-dev] [PATCH AUTOSEL 5.6 040/129] f2fs: fix to show norecovery mount option Sasha Levin
2020-04-15 11:33 ` [f2fs-dev] [PATCH AUTOSEL 5.6 044/129] f2fs: fix to update f2fs_super_block fields under sb_lock Sasha Levin
2020-04-15 11:33 ` [f2fs-dev] [PATCH AUTOSEL 5.6 045/129] f2fs: Fix mount failure due to SPO after a successful online resize FS Sasha Levin
2020-04-15 11:33 ` [f2fs-dev] [PATCH AUTOSEL 5.6 046/129] f2fs: Add a new CP flag to help fsck fix resize SPO issues Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 096/129] f2fs: compress: fix to call missing destroy_compress_ctx() Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 097/129] f2fs: fix potential .flags overflow on 32bit architecture Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 098/129] f2fs: fix NULL pointer dereference in f2fs_verity_work() Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 099/129] f2fs: fix NULL pointer dereference in f2fs_write_begin() Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 100/129] f2fs: fix potential deadlock on compressed quota file Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 113/129] f2fs: fix to account compressed blocks in f2fs_compressed_blocks() Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 114/129] f2fs: skip GC when section is full Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 127/129] f2fs: fix leaking uninitialized memory in compressed clusters Sasha Levin
2020-04-15 11:34 ` [f2fs-dev] [PATCH AUTOSEL 5.6 128/129] f2fs: fix to wait all node page writeback Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200415113445.11881-14-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).