[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <81a55b36-0a69-42d6-b82a-94499c37a4fd@kernel.org>
Date: Mon, 4 Nov 2024 11:30:38 +0800
From: Chao Yu <chao@...nel.org>
To: Long Li <leo.lilong@...wei.com>, jaegeuk@...nel.org
Cc: Chao Yu <chao@...nel.org>, linux-f2fs-devel@...ts.sourceforge.net,
linux-kernel@...r.kernel.org, yi.zhang@...wei.com, yangerkun@...wei.com,
lonuxli.64@...il.com
Subject: Re: [PATCH v2] f2fs: fix race in concurrent f2fs_stop_gc_thread
On 2024/11/4 10:05, Long Li wrote:
> In my test case, concurrent calls to f2fs shutdown report the following
> stack trace:
>
> Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI
> CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85
> Call Trace:
> <TASK>
> ? show_regs+0x8b/0xa0
> ? __die_body+0x26/0xa0
> ? die_addr+0x54/0x90
> ? exc_general_protection+0x24b/0x5c0
> ? asm_exc_general_protection+0x26/0x30
> ? kthread_stop+0x46/0x390
> f2fs_stop_gc_thread+0x6c/0x110
> f2fs_do_shutdown+0x309/0x3a0
> f2fs_ioc_shutdown+0x150/0x1c0
> __f2fs_ioctl+0xffd/0x2ac0
> f2fs_ioctl+0x76/0xe0
> vfs_ioctl+0x23/0x60
> __x64_sys_ioctl+0xce/0xf0
> x64_sys_call+0x2b1b/0x4540
> do_syscall_64+0xa7/0x240
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> The root cause is a race condition in f2fs_stop_gc_thread() called from
> different f2fs shutdown paths:
>
> [CPU0] [CPU1]
> ---------------------- -----------------------
> f2fs_stop_gc_thread f2fs_stop_gc_thread
> gc_th = sbi->gc_thread
> gc_th = sbi->gc_thread
> kfree(gc_th)
> sbi->gc_thread = NULL
> < gc_th != NULL >
> kthread_stop(gc_th->f2fs_gc_task) //UAF
>
> The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in
> f2fs_stop_gc_thread()") attempted to fix this issue by using a read
> semaphore to prevent races between shutdown and remount threads, but
> it fails to prevent all race conditions.
>
> Fix it by converting to write lock of s_umount in f2fs_do_shutdown().
>
> Fixes: 7950e9ac638e ("f2fs: stop gc/discard thread after fs shutdown")
> Signed-off-by: Long Li <leo.lilong@...wei.com>
Reviewed-by: Chao Yu <chao@...nel.org>
Thanks,
Powered by blists - more mailing lists