| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 16 May 2024 18:13:38 +0800
From: sunshijie <sunshijie@...omi.corp-partner.google.com>
To: jaegeuk@...nel.org,
chao@...nel.org,
linux-f2fs-devel@...ts.sourceforge.net,
linux-kernel@...r.kernel.org
Cc: sunshijie <sunshijie@...omi.com>
Subject: [PATCH] f2fs: fix panic in f2fs_put_super
When thread A calls kill_f2fs_super, Thread A first executes the code sbi->node_inode = NULL;
Then thread A may submit a bio to the function iput(sbi->meta_inode);
Then thread A enters the process D state,
Now that the bio submitted by thread A is complete, it calls f2fs_write_end_io and may trigger null-ptr-deref in NODE_MAPPING.
Thread A IRQ context
- f2fs_put_super
- sbi->node_inode = NULL;
- iput(sbi->meta_inode);
- iput_final
- write_inode_now
- writeback_single_inode
- __writeback_single_inode
- filemap_fdatawait
- filemap_fdatawait_range
- __kcfi_typeid_free_transhuge_page
- __filemap_fdatawait_range
- wait_on_page_writeback
- folio_wait_writeback
- folio_wait_bit
- folio_wait_bit_common
- io_schedule
- __handle_irq_event_percpu
- ufs_qcom_mcq_esi_handler
- ufshcd_mcq_poll_cqe_nolock
- ufshcd_compl_one_cqe
- scsi_done
- scsi_done_internal
- blk_mq_complete_request
- scsi_complete
- scsi_finish_command
- scsi_io_completion
- scsi_end_request
- blk_update_request
- bio_endio
- f2fs_write_end_io
- NODE_MAPPING(sbi)
Signed-off-by: sunshijie <sunshijie@...omi.com>
---
fs/f2fs/super.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index adffc9b80a9c..62d4f229f601 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1642,9 +1642,9 @@ static void f2fs_put_super(struct super_block *sb)
f2fs_destroy_compress_inode(sbi);
iput(sbi->node_inode);
- sbi->node_inode = NULL;
-
iput(sbi->meta_inode);
+
+ sbi->node_inode = NULL;
sbi->meta_inode = NULL;
mutex_unlock(&sbi->umount_mutex);
--
2.34.1
Powered by blists - more mailing lists