mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/fs/f2fs
History
Chao Yu 91586ce0d3 f2fs: fix to invalidate dcc->f2fs_issue_discard in error path 
Syzbot reports a NULL pointer dereference issue as below:

 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_task_struct include/linux/sched/task.h:110 [inline]
 kthread_stop+0x34/0x1c0 kernel/kthread.c:703
 f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638
 kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522
 deactivate_locked_super+0x70/0xe8 fs/super.c:332
 deactivate_super+0xd0/0xd4 fs/super.c:363
 cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193
 task_work_run+0xc4/0x14c kernel/task_work.c:177
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x26c/0xbe0 kernel/exit.c:795
 do_group_exit+0x60/0xe8 kernel/exit.c:925
 __do_sys_exit_group kernel/exit.c:936 [inline]
 __se_sys_exit_group kernel/exit.c:934 [inline]
 __wake_up_parent+0x0/0x40 kernel/exit.c:934
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

The root cause of this issue is in error path of f2fs_start_discard_thread(),
it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may
access invalid pointer.

Fixes: 4d67490498 ("f2fs: Don't create discard thread when device doesn't support realtime discard")
Reported-by: syzbot+035a381ea1afb63f098d@syzkaller.appspotmail.com
Reported-by: syzbot+729c925c2d9fc495ddee@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
 		2022-11-01 17:56:01 -07:00
..
Kconfig f2fs: introduce F2FS_UNFAIR_RWSEM to support unfair rwsem 2022-03-04 09:15:53 -08:00
Makefile f2fs: separate out iostat feature 2021-08-23 10:25:51 -07:00
acl.c f2fs: port to vfs{g,u}id_t and associated helpers 2022-10-04 13:31:43 -07:00
acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
checkpoint.c f2fs: support recording stop_checkpoint reason into super_block 2022-10-04 13:31:44 -07:00
compress.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
data.c f2fs-for-6.1-rc1 2022-10-10 20:28:41 -07:00
debug.c f2fs: change to use atomic_t type form sbi.atomic_files 2022-10-07 12:57:26 -07:00
dir.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
extent_cache.c f2fs: code clean and fix a type error 2022-10-04 13:31:44 -07:00
f2fs.h f2fs-for-6.1-rc1 2022-10-10 20:28:41 -07:00
file.c f2fs-for-6.1-rc1 2022-10-10 20:28:41 -07:00
gc.c f2fs: Fix the race condition of resize flag between resizefs 2022-10-27 20:25:59 -07:00
gc.h f2fs: remove redundant code for gc condition 2022-07-30 20:16:20 -07:00
hash.c f2fs: don't use casefolded comparison for "." and ".." 2022-05-17 11:19:23 -07:00
inline.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
inode.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
iostat.c f2fs: iostat: support accounting compressed IO 2022-08-29 21:15:51 -07:00
iostat.h f2fs: iostat: support accounting compressed IO 2022-08-29 21:15:51 -07:00
namei.c f2fs: let's avoid to get cp_rwsem twice by f2fs_evict_inode by d_invalidate 2022-10-25 10:44:27 -07:00
node.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
node.h f2fs: change the current atomic write way 2022-05-12 10:14:03 -07:00
recovery.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
segment.c f2fs: fix to invalidate dcc->f2fs_issue_discard in error path 2022-11-01 17:56:01 -07:00
segment.h f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
shrinker.c f2fs: avoid race condition for shrinker count 2020-12-03 00:59:26 -08:00
super.c f2fs-for-6.1-rc1 2022-10-10 20:28:41 -07:00
sysfs.c f2fs: introduce cp_status sysfs entry 2022-10-04 13:31:44 -07:00
verity.c - Alistair Popple has a series which addresses a race which causes page 2022-10-14 12:28:43 -07:00
xattr.c f2fs: support recording errors into superblock 2022-10-04 13:31:45 -07:00
xattr.h f2fs: code cleanup by removing ifdef macro surrounding 2020-05-26 18:56:10 -07:00