* [f2fs-dev] [PATCH] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
@ 2022-12-30 15:43 Chao Yu
2023-01-03 17:03 ` patchwork-bot+f2fs
0 siblings, 1 reply; 3+ messages in thread
From: Chao Yu @ 2022-12-30 15:43 UTC (permalink / raw)
To: jaegeuk; +Cc: linux-kernel, linux-f2fs-devel
With below two cases, it will cause NULL pointer dereference when
accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
release SM_I(sbi)->fcc_info,
- mount -o noflush_merge /dev/vda /mnt/f2fs
- mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below
testcase,
- mount -o ro /dev/vda /mnt/f2fs
- mount -o rw,remount /dev/vda /mnt/f2fs
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
In order to fix this issue, let change as below:
- fix error path handling in f2fs_create_flush_cmd_control().
- allocate SM_I(sbi)->fcc_info even if readonly is on.
Signed-off-by: Chao Yu <chao@kernel.org>
---
fs/f2fs/segment.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 2646575f43de..16f60c646cc2 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -663,8 +663,7 @@ int f2fs_create_flush_cmd_control(struct f2fs_sb_info *sbi)
if (IS_ERR(fcc->f2fs_issue_flush)) {
int err = PTR_ERR(fcc->f2fs_issue_flush);
- kfree(fcc);
- SM_I(sbi)->fcc_info = NULL;
+ fcc->f2fs_issue_flush = NULL;
return err;
}
@@ -5137,11 +5136,9 @@ int f2fs_build_segment_manager(struct f2fs_sb_info *sbi)
init_f2fs_rwsem(&sm_info->curseg_lock);
- if (!f2fs_readonly(sbi->sb)) {
- err = f2fs_create_flush_cmd_control(sbi);
- if (err)
- return err;
- }
+ err = f2fs_create_flush_cmd_control(sbi);
+ if (err)
+ return err;
err = create_discard_cmd_control(sbi);
if (err)
--
2.36.1
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [f2fs-dev] [PATCH] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
2022-12-30 15:43 [f2fs-dev] [PATCH] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() Chao Yu
@ 2023-01-03 17:03 ` patchwork-bot+f2fs
2023-01-04 1:53 ` Yuwei Guan
0 siblings, 1 reply; 3+ messages in thread
From: patchwork-bot+f2fs @ 2023-01-03 17:03 UTC (permalink / raw)
To: Chao Yu; +Cc: jaegeuk, linux-kernel, linux-f2fs-devel
Hello:
This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@kernel.org>:
On Fri, 30 Dec 2022 23:43:32 +0800 you wrote:
> With below two cases, it will cause NULL pointer dereference when
> accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
>
> a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
> release SM_I(sbi)->fcc_info,
>
> - mount -o noflush_merge /dev/vda /mnt/f2fs
> - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails
> - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
>
> [...]
Here is the summary with links:
- [f2fs-dev] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
https://git.kernel.org/jaegeux/f2fs/c/b3d83066cbeb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [f2fs-dev] [PATCH] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
2023-01-03 17:03 ` patchwork-bot+f2fs
@ 2023-01-04 1:53 ` Yuwei Guan
0 siblings, 0 replies; 3+ messages in thread
From: Yuwei Guan @ 2023-01-04 1:53 UTC (permalink / raw)
To: patchwork-bot+f2fs; +Cc: jaegeuk, linux-kernel, linux-f2fs-devel
<patchwork-bot+f2fs@kernel.org> 于2023年1月4日周三 01:04写道:
>
> Hello:
>
> This patch was applied to jaegeuk/f2fs.git (dev)
> by Jaegeuk Kim <jaegeuk@kernel.org>:
>
> On Fri, 30 Dec 2022 23:43:32 +0800 you wrote:
> > With below two cases, it will cause NULL pointer dereference when
> > accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
> >
> > a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
> > release SM_I(sbi)->fcc_info,
> >
> > - mount -o noflush_merge /dev/vda /mnt/f2fs
> > - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails
> > - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
> >
> > [...]
>
> Here is the summary with links:
> - [f2fs-dev] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
> https://git.kernel.org/jaegeux/f2fs/c/b3d83066cbeb
>
Hi jeageuk,
There is a character error in patchwork configuration, :).
:s/jaegeux/jeageuk/g
> You are awesome, thank you!
> --
> Deet-doot-dot, I am a bot.
> https://korg.docs.kernel.org/patchwork/pwbot.html
>
>
>
>
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-01-04 1:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-30 15:43 [f2fs-dev] [PATCH] f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() Chao Yu
2023-01-03 17:03 ` patchwork-bot+f2fs
2023-01-04 1:53 ` Yuwei Guan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).