linux-kernel - [PATCH 2/2] Revert "f2fs: fix to avoid use-after-free in f2fs_stop_gc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241031064553.55283-2-leo.lilong@huawei.com>
Date: Thu, 31 Oct 2024 14:45:53 +0800
From: Long Li <leo.lilong@...wei.com>
To: <jaegeuk@...nel.org>, <chao@...nel.org>
CC: <linux-f2fs-devel@...ts.sourceforge.net>, <linux-kernel@...r.kernel.org>,
	<yi.zhang@...wei.com>, <leo.lilong@...wei.com>, <yangerkun@...wei.com>,
	<lonuxli.64@...il.com>
Subject: [PATCH 2/2] Revert "f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()"

This reverts commit c7f114d864ac91515bb07ac271e9824a20f5ed95.

The race conditions between concurrent f2fs_stop_gc_thread() calls
are now protected by a dedicated lock, making the additional s_umount
lock protection unnecessary. Therefore, revert this patch.

Signed-off-by: Long Li <leo.lilong@...wei.com>
---
 fs/f2fs/f2fs.h  |  2 +-
 fs/f2fs/file.c  | 11 ++---------
 fs/f2fs/super.c |  2 +-
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 7ae1e2a4789f..2143604ce416 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3522,7 +3522,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 int f2fs_truncate_hole(struct inode *inode, pgoff_t pg_start, pgoff_t pg_end);
 void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count);
 int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
-						bool readonly, bool need_lock);
+							bool readonly);
 int f2fs_precache_extents(struct inode *inode);
 int f2fs_fileattr_get(struct dentry *dentry, struct fileattr *fa);
 int f2fs_fileattr_set(struct mnt_idmap *idmap,
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 75a8b22da664..5d7b4fdae9c4 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2318,7 +2318,7 @@ static int f2fs_ioc_abort_atomic_write(struct file *filp)
 }
 
 int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
-						bool readonly, bool need_lock)
+							bool readonly)
 {
 	struct super_block *sb = sbi->sb;
 	int ret = 0;
@@ -2365,19 +2365,12 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
 	if (readonly)
 		goto out;
 
-	/* grab sb->s_umount to avoid racing w/ remount() */
-	if (need_lock)
-		down_read(&sbi->sb->s_umount);
-
 	f2fs_stop_gc_thread(sbi);
 	f2fs_stop_discard_thread(sbi);
 
 	f2fs_drop_discard_cmd(sbi);
 	clear_opt(sbi, DISCARD);
 
-	if (need_lock)
-		up_read(&sbi->sb->s_umount);
-
 	f2fs_update_time(sbi, REQ_TIME);
 out:
 
@@ -2414,7 +2407,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
 		}
 	}
 
-	ret = f2fs_do_shutdown(sbi, in, readonly, true);
+	ret = f2fs_do_shutdown(sbi, in, readonly);
 
 	if (need_drop)
 		mnt_drop_write_file(filp);
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 47a15050ea9c..a720fb9ef196 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2569,7 +2569,7 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
 
 static void f2fs_shutdown(struct super_block *sb)
 {
-	f2fs_do_shutdown(F2FS_SB(sb), F2FS_GOING_DOWN_NOSYNC, false, false);
+	f2fs_do_shutdown(F2FS_SB(sb), F2FS_GOING_DOWN_NOSYNC, false);
 }
 
 #ifdef CONFIG_QUOTA
-- 
2.39.2