* [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory
@ 2021-11-04 8:22 Dongliang Mu
2021-11-04 8:37 ` Chao Yu
0 siblings, 1 reply; 2+ messages in thread
From: Dongliang Mu @ 2021-11-04 8:22 UTC (permalink / raw)
To: Jaegeuk Kim, Chao Yu, Sahitya Tummala
Cc: Dongliang Mu, linux-f2fs-devel, linux-kernel
if2fs_fill_super
-> f2fs_build_segment_manager
-> create_discard_cmd_control
-> f2fs_start_discard_thread
It invokes kthread_run to create a thread and run issue_discard_thread.
However, if f2fs_build_node_manager fails, the control flow goes to
free_nm and calls f2fs_destroy_node_manager. This function will free
sbi->nm_info. However, if issue_discard_thread accesses sbi->nm_info
after the deallocation, but before the f2fs_stop_discard_thread, it will
cause UAF(Use-after-free).
-> f2fs_destroy_segment_manager
-> destroy_discard_cmd_control
-> f2fs_stop_discard_thread
Fix this by stopping discard thread before f2fs_destroy_node_manager.
Note that, the commit d6d2b491a82e1 introduces the call of
f2fs_available_free_memory into issue_discard_thread.
Fixes: d6d2b491a82e ("f2fs: allow to change discard policy based on cached discard cmds")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
fs/f2fs/super.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 78ebc306ee2b..dbe040b66802 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4352,6 +4352,8 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
free_stats:
f2fs_destroy_stats(sbi);
free_nm:
+ /* stop discard thread before destroying node manager */
+ f2fs_stop_discard_thread(sbi);
f2fs_destroy_node_manager(sbi);
free_sm:
f2fs_destroy_segment_manager(sbi);
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory
2021-11-04 8:22 [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory Dongliang Mu
@ 2021-11-04 8:37 ` Chao Yu
0 siblings, 0 replies; 2+ messages in thread
From: Chao Yu @ 2021-11-04 8:37 UTC (permalink / raw)
To: Dongliang Mu, Jaegeuk Kim, Sahitya Tummala; +Cc: linux-f2fs-devel, linux-kernel
On 2021/11/4 16:22, Dongliang Mu wrote:
> if2fs_fill_super
> -> f2fs_build_segment_manager
> -> create_discard_cmd_control
> -> f2fs_start_discard_thread
>
> It invokes kthread_run to create a thread and run issue_discard_thread.
>
> However, if f2fs_build_node_manager fails, the control flow goes to
> free_nm and calls f2fs_destroy_node_manager. This function will free
> sbi->nm_info. However, if issue_discard_thread accesses sbi->nm_info
> after the deallocation, but before the f2fs_stop_discard_thread, it will
> cause UAF(Use-after-free).
>
> -> f2fs_destroy_segment_manager
> -> destroy_discard_cmd_control
> -> f2fs_stop_discard_thread
>
> Fix this by stopping discard thread before f2fs_destroy_node_manager.
>
> Note that, the commit d6d2b491a82e1 introduces the call of
> f2fs_available_free_memory into issue_discard_thread.
>
> Fixes: d6d2b491a82e ("f2fs: allow to change discard policy based on cached discard cmds")
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-04 8:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-04 8:22 [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory Dongliang Mu
2021-11-04 8:37 ` Chao Yu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).