target/linux/bcm27xx/patches-6.1/950-0842-f2fs-fix-to-avoid-NULL-pointer-dereference-in-f2fs_i.patch

   1 From bf9fb25f3265605572f04e5c7836bb83ee345236 Mon Sep 17 00:00:00 2001
   2 From: Chao Yu <chao@kernel.org>
   3 Date: Fri, 30 Dec 2022 23:43:32 +0800
   4 Subject: [PATCH] f2fs: fix to avoid NULL pointer dereference in
   5  f2fs_issue_flush()
   6
   7 commit b3d83066cbebc76dbac8a5fca931f64b4c6fff34 upstream.
   8
   9 With below two cases, it will cause NULL pointer dereference when
  10 accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().
  11
  12 a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
  13 release SM_I(sbi)->fcc_info,
  14
  15 - mount -o noflush_merge /dev/vda /mnt/f2fs
  16 - mount -o remount,flush_merge /dev/vda /mnt/f2fs  -- kthread_run() fails
  17 - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
  18
  19 b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below
  20 testcase,
  21
  22 - mount -o ro /dev/vda /mnt/f2fs
  23 - mount -o rw,remount /dev/vda /mnt/f2fs
  24 - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync
  25
  26 In order to fix this issue, let change as below:
  27 - fix error path handling in f2fs_create_flush_cmd_control().
  28 - allocate SM_I(sbi)->fcc_info even if readonly is on.
  29
  30 Signed-off-by: Chao Yu <chao@kernel.org>
  31 Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
  32 ---
  33  fs/f2fs/segment.c | 12 ++++--------
  34  1 file changed, 4 insertions(+), 8 deletions(-)
  35
  36 --- a/fs/f2fs/segment.c
  37 +++ b/fs/f2fs/segment.c
  38 @@ -665,9 +665,7 @@ init_thread:
  39                                 "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
  40         if (IS_ERR(fcc->f2fs_issue_flush)) {
  41                 err = PTR_ERR(fcc->f2fs_issue_flush);
  42 -               kfree(fcc);
  43 -               SM_I(sbi)->fcc_info = NULL;
  44 -               return err;
  45 +               fcc->f2fs_issue_flush = NULL;
  46         }
  47
  48         return err;
  49 @@ -5064,11 +5062,9 @@ int f2fs_build_segment_manager(struct f2
  50
  51         init_f2fs_rwsem(&sm_info->curseg_lock);
  52
  53 -       if (!f2fs_readonly(sbi->sb)) {
  54 -               err = f2fs_create_flush_cmd_control(sbi);
  55 -               if (err)
  56 -                       return err;
  57 -       }
  58 +       err = f2fs_create_flush_cmd_control(sbi);
  59 +       if (err)
  60 +               return err;
  61
  62         err = create_discard_cmd_control(sbi);
  63         if (err)