From: Chao Yu <chao@kernel.org>
To: Dongliang Mu <mudongliangabcd@gmail.com>,
Jaegeuk Kim <jaegeuk@kernel.org>,
Sahitya Tummala <stummala@codeaurora.org>
Cc: linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory
Date: Thu, 4 Nov 2021 16:37:41 +0800 [thread overview]
Message-ID: <b071e877-334e-b669-e2df-abe4d5927418@kernel.org> (raw)
In-Reply-To: <20211104082202.1286551-1-mudongliangabcd@gmail.com>
On 2021/11/4 16:22, Dongliang Mu wrote:
> if2fs_fill_super
> -> f2fs_build_segment_manager
> -> create_discard_cmd_control
> -> f2fs_start_discard_thread
>
> It invokes kthread_run to create a thread and run issue_discard_thread.
>
> However, if f2fs_build_node_manager fails, the control flow goes to
> free_nm and calls f2fs_destroy_node_manager. This function will free
> sbi->nm_info. However, if issue_discard_thread accesses sbi->nm_info
> after the deallocation, but before the f2fs_stop_discard_thread, it will
> cause UAF(Use-after-free).
>
> -> f2fs_destroy_segment_manager
> -> destroy_discard_cmd_control
> -> f2fs_stop_discard_thread
>
> Fix this by stopping discard thread before f2fs_destroy_node_manager.
>
> Note that, the commit d6d2b491a82e1 introduces the call of
> f2fs_available_free_memory into issue_discard_thread.
>
> Fixes: d6d2b491a82e ("f2fs: allow to change discard policy based on cached discard cmds")
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Chao Yu <chao@kernel.org>
To: Dongliang Mu <mudongliangabcd@gmail.com>,
Jaegeuk Kim <jaegeuk@kernel.org>,
Sahitya Tummala <stummala@codeaurora.org>
Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory
Date: Thu, 4 Nov 2021 16:37:41 +0800 [thread overview]
Message-ID: <b071e877-334e-b669-e2df-abe4d5927418@kernel.org> (raw)
In-Reply-To: <20211104082202.1286551-1-mudongliangabcd@gmail.com>
On 2021/11/4 16:22, Dongliang Mu wrote:
> if2fs_fill_super
> -> f2fs_build_segment_manager
> -> create_discard_cmd_control
> -> f2fs_start_discard_thread
>
> It invokes kthread_run to create a thread and run issue_discard_thread.
>
> However, if f2fs_build_node_manager fails, the control flow goes to
> free_nm and calls f2fs_destroy_node_manager. This function will free
> sbi->nm_info. However, if issue_discard_thread accesses sbi->nm_info
> after the deallocation, but before the f2fs_stop_discard_thread, it will
> cause UAF(Use-after-free).
>
> -> f2fs_destroy_segment_manager
> -> destroy_discard_cmd_control
> -> f2fs_stop_discard_thread
>
> Fix this by stopping discard thread before f2fs_destroy_node_manager.
>
> Note that, the commit d6d2b491a82e1 introduces the call of
> f2fs_available_free_memory into issue_discard_thread.
>
> Fixes: d6d2b491a82e ("f2fs: allow to change discard policy based on cached discard cmds")
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
next prev parent reply other threads:[~2021-11-04 8:37 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-04 8:22 [f2fs-dev] [PATCH v2] fs: f2fs: fix UAF in f2fs_available_free_memory Dongliang Mu
2021-11-04 8:22 ` Dongliang Mu
2021-11-04 8:37 ` Chao Yu [this message]
2021-11-04 8:37 ` Chao Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b071e877-334e-b669-e2df-abe4d5927418@kernel.org \
--to=chao@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mudongliangabcd@gmail.com \
--cc=stummala@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.