diff mbox series

f2fs: fix kernel crash due to null io->bio

Message ID 20230206034344.724593-1-jaegeuk@kernel.org
State New
Headers
Series f2fs: fix kernel crash due to null io->bio |

Commit Message

Jaegeuk Kim Feb. 6, 2023, 3:43 a.m. UTC 
  We should return when io->bio is null before doing anything. Otherwise, panic.

BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs]
Call Trace:
 <TASK>
 f2fs_submit_merged_write+0x1d/0x30 [f2fs]
 commit_checkpoint+0x110/0x1e0 [f2fs]
 f2fs_write_checkpoint+0x9f7/0xf00 [f2fs]
 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
 __checkpoint_and_complete_reqs+0x84/0x190 [f2fs]
 ? preempt_count_add+0x82/0xc0
 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
 issue_checkpoint_thread+0x4c/0xf0 [f2fs]
 ? __pfx_autoremove_wake_function+0x10/0x10
 kthread+0xff/0x130
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 </TASK>

Cc: stable@vger.kernel.org # v5.18+
Fixes: 64bf0eef0171 ("f2fs: pass the bio operation to bio_alloc_bioset")
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
---
 fs/f2fs/data.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Chao Yu Feb. 7, 2023, 12:35 p.m. UTC | #1 
On 2023/2/6 11:43, Jaegeuk Kim wrote:
> We should return when io->bio is null before doing anything. Otherwise, panic.
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000010
> RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs]
> Call Trace:
>   <TASK>
>   f2fs_submit_merged_write+0x1d/0x30 [f2fs]
>   commit_checkpoint+0x110/0x1e0 [f2fs]
>   f2fs_write_checkpoint+0x9f7/0xf00 [f2fs]
>   ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
>   __checkpoint_and_complete_reqs+0x84/0x190 [f2fs]
>   ? preempt_count_add+0x82/0xc0
>   ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
>   issue_checkpoint_thread+0x4c/0xf0 [f2fs]
>   ? __pfx_autoremove_wake_function+0x10/0x10
>   kthread+0xff/0x130
>   ? __pfx_kthread+0x10/0x10
>   ret_from_fork+0x2c/0x50
>   </TASK>
> 
> Cc: stable@vger.kernel.org # v5.18+
> Fixes: 64bf0eef0171 ("f2fs: pass the bio operation to bio_alloc_bioset")
> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,
patchwork-bot+f2fs@kernel.org Feb. 7, 2023, 7 p.m. UTC | #2 
Hello:

This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@kernel.org>:

On Sun,  5 Feb 2023 19:43:44 -0800 you wrote:
> We should return when io->bio is null before doing anything. Otherwise, panic.
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000010
> RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs]
> Call Trace:
>  <TASK>
>  f2fs_submit_merged_write+0x1d/0x30 [f2fs]
>  commit_checkpoint+0x110/0x1e0 [f2fs]
>  f2fs_write_checkpoint+0x9f7/0xf00 [f2fs]
>  ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
>  __checkpoint_and_complete_reqs+0x84/0x190 [f2fs]
>  ? preempt_count_add+0x82/0xc0
>  ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
>  issue_checkpoint_thread+0x4c/0xf0 [f2fs]
>  ? __pfx_autoremove_wake_function+0x10/0x10
>  kthread+0xff/0x130
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x2c/0x50
>  </TASK>
> 
> [...]

Here is the summary with links:
  - [f2fs-dev] f2fs: fix kernel crash due to null io->bio
    https://git.kernel.org/jaegeuk/f2fs/c/267c159f9c7b

You are awesome, thank you!
diff mbox series

Patch

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 12f233f2fd58..ea8311a58ab7 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -653,6 +653,9 @@  static void __f2fs_submit_merged_write(struct f2fs_sb_info *sbi,
 
 	f2fs_down_write(&io->io_rwsem);
 
+	if (!io->bio)
+		goto unlock_out;
+
 	/* change META to META_FLUSH in the checkpoint procedure */
 	if (type >= META_FLUSH) {
 		io->fio.type = META_FLUSH;
@@ -661,6 +664,7 @@  static void __f2fs_submit_merged_write(struct f2fs_sb_info *sbi,
 			io->bio->bi_opf |= REQ_PREFLUSH | REQ_FUA;
 	}
 	__submit_merged_bio(io);
+unlock_out:
 	f2fs_up_write(&io->io_rwsem);
 }