diff mbox series

f2fs: fix error path of f2fs_create_flush_cmd_control()

Message ID 20221230132856.4248-1-chao@kernel.org
State New
Headers
Series f2fs: fix error path of f2fs_create_flush_cmd_control() |

Commit Message

Chao Yu Dec. 30, 2022, 1:28 p.m. UTC 
  If kthread_run() fails in f2fs_create_flush_cmd_control(), it should
not release SM_I(sbi)->fcc_info, otherwise, w/ below testcase, it will
cause NULL pointer dereference when accessing SM_I(sbi)->fcc_info
in f2fs_issue_flush().

- mount -o noflush_merge /dev/vda /mnt/f2fs
- mount -o remount,flush_merge /dev/vda /mnt/f2fs  -- kthread_run() fails
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync

Signed-off-by: Chao Yu <chao@kernel.org>
---
 fs/f2fs/segment.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 2646575f43de..7b18e8c02f5d 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -663,8 +663,7 @@  int f2fs_create_flush_cmd_control(struct f2fs_sb_info *sbi)
 	if (IS_ERR(fcc->f2fs_issue_flush)) {
 		int err = PTR_ERR(fcc->f2fs_issue_flush);
 
-		kfree(fcc);
-		SM_I(sbi)->fcc_info = NULL;
+		fcc->f2fs_issue_flush = NULL;
 		return err;
 	}