Message ID | 20221021023422.3101585-1-chao@kernel.org |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp442589wrr; Thu, 20 Oct 2022 19:42:21 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7CFIMS4QQTe5gVPCQoN3SNsskbPBwtew7Tp39GMzZTBUNcAXk9l+TaYXBk05+XUpOkMLqm X-Received: by 2002:a17:90a:c250:b0:20a:e484:63aa with SMTP id d16-20020a17090ac25000b0020ae48463aamr19815812pjx.0.1666320141662; Thu, 20 Oct 2022 19:42:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666320141; cv=none; d=google.com; s=arc-20160816; b=iHSndiKQGnjhw+8MIYXZg2qEmX5MvggbEAYslHsARNQRhRR+H2OTIsrXc1H9hdzFKQ 9qHAywFJ41vdV7whF2h7R07018BFqXnic/FrRtEeGtHWfOx5Npb8zXDOM9urwhe18pKm JiN6y5WlFPynJoZTHbOr+gV7YXZZ4tsSdt5l5u+YGIY3N/nLzqp8NkWTQhLHRkE7XC71 lE7NfRii82xUqN/z/u3bmMYlqnpMjv5vwpzO+NKTylpAkpS0a4zhTaOo5BcHIGQeSyNk 4SdMCiIILibHhPb26QprQAemtpiVyjaLMHS7XNOnhAdNLB8H4ZoGMxAZZVlQVBCQyFsj wZPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=s1wgIypwdn9SOXs6g/3584fsvIMdmLVGb86gGiVc2lA=; b=XtaRHNWnkHD8H4R6bpuWKixlBYhToDe0qkvLUfuWKFowVSy/I+ldXqiy/jJ75f8Fxs g9mrtClQgMEqWb36xdIweQy+fCycgUe/JJeyNtg8uzTqYOlkgpd5pvfifhiLRRD7BYVI Rg3Ny1vZ6MBOcv5TfFppLIFlPe2LuQK4yLzDEaLcnDpNosxlJg9nWBL4WgOByXM2YxZh XcC8X1mY4YzSeLemRnKkN57+AH5rJ/C4gy7qHBKXADf9puCWUwxvImh2CImkT4dmU5M7 ogDXl6DXz+1S2KD/oaSDlaFCEJSIpJwX3xHa8khxBKdsUksXYHQ9ODtF9ojlVZKhU1hF kz6A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=CGXMB7pF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w184-20020a6282c1000000b00562e2899394si21470436pfd.310.2022.10.20.19.42.08; Thu, 20 Oct 2022 19:42:21 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=CGXMB7pF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229911AbiJUCen (ORCPT <rfc822;pwkd43@gmail.com> + 99 others); Thu, 20 Oct 2022 22:34:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229895AbiJUCej (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 20 Oct 2022 22:34:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B139F36BDF for <linux-kernel@vger.kernel.org>; Thu, 20 Oct 2022 19:34:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A70FCB8291C for <linux-kernel@vger.kernel.org>; Fri, 21 Oct 2022 02:34:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55601C4FEB9; Fri, 21 Oct 2022 02:34:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1666319674; bh=580rqartSgXXhJapFprYMMcudTR1XAKCGjA2+wbw7n0=; h=From:To:Cc:Subject:Date:From; b=CGXMB7pFLUwX0p6r8P7m3dddcVf8gdsoPBzDzWG0l+lK/r7v4x/nEExifC6QyObmF zAnu7jChIwUvsGFqnK41++j/hSrhpfsACUVDVWOI5XTyro93r/zqZUjlfU1s4m77KO gjqVYYBnxYfTCKIBZUCE/XVIM2525JQpSVOA1RnXeJBniR5Xj0KbHz8Vuy+LYvHAdX SGWaZcMXu6qXTtPCJaHNDnckA3feuWCls0b6S4w9Tu0AZnsTXh9K9cqMPRFzCJAP19 HqgLHGyUtF9/jcVtOSazyp3M7QQNBurKnP45rBSOglYk+si+KlBoB1PGRiSt20KUYK XTXirLrSraxZw== From: Chao Yu <chao@kernel.org> To: jaegeuk@kernel.org Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Chao Yu <chao@kernel.org>, syzbot+035a381ea1afb63f098d@syzkaller.appspotmail.com, syzbot+729c925c2d9fc495ddee@syzkaller.appspotmail.com Subject: [PATCH v2] f2fs: fix to invalidate dcc->f2fs_issue_discard in error path Date: Fri, 21 Oct 2022 10:34:22 +0800 Message-Id: <20221021023422.3101585-1-chao@kernel.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747263308952865766?= X-GMAIL-MSGID: =?utf-8?q?1747263308952865766?= |
Series |
[v2] f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
|
|
Commit Message
Chao Yu
Oct. 21, 2022, 2:34 a.m. UTC
Syzbot reports a NULL pointer dereference issue as below:
__refcount_add include/linux/refcount.h:193 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
get_task_struct include/linux/sched/task.h:110 [inline]
kthread_stop+0x34/0x1c0 kernel/kthread.c:703
f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638
kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522
deactivate_locked_super+0x70/0xe8 fs/super.c:332
deactivate_super+0xd0/0xd4 fs/super.c:363
cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0xc4/0x14c kernel/task_work.c:177
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x26c/0xbe0 kernel/exit.c:795
do_group_exit+0x60/0xe8 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:934
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
The root cause of this issue is in error path of f2fs_start_discard_thread(),
it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may
access invalid pointer.
Fixes: 4d67490498ac ("f2fs: Don't create discard thread when device doesn't support realtime discard")
Reported-by: syzbot+035a381ea1afb63f098d@syzkaller.appspotmail.com
Reported-by: syzbot+729c925c2d9fc495ddee@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <chao@kernel.org>
---
v2:
- add more commit message and Fixes and Reported-by tag.
fs/f2fs/segment.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index acf3d3fa4363..7a4f7c88b8b9 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -2025,8 +2025,10 @@ int f2fs_start_discard_thread(struct f2fs_sb_info *sbi) dcc->f2fs_issue_discard = kthread_run(issue_discard_thread, sbi, "f2fs_discard-%u:%u", MAJOR(dev), MINOR(dev)); - if (IS_ERR(dcc->f2fs_issue_discard)) + if (IS_ERR(dcc->f2fs_issue_discard)) { err = PTR_ERR(dcc->f2fs_issue_discard); + dcc->f2fs_issue_discard = NULL; + } return err; }