• S
    f2fs: fix use-after-free issue when accessing sbi->stat_info · 69e7f877
    Sahitya Tummala 提交于
    [ Upstream commit 60aa4d5536ab7fe32433ca1173bd9d6633851f27 ]
    
    iput() on sbi->node_inode can update sbi->stat_info
    in the below context, if the f2fs_write_checkpoint()
    has failed with error.
    
    f2fs_balance_fs_bg+0x1ac/0x1ec
    f2fs_write_node_pages+0x4c/0x260
    do_writepages+0x80/0xbc
    __writeback_single_inode+0xdc/0x4ac
    writeback_single_inode+0x9c/0x144
    write_inode_now+0xc4/0xec
    iput+0x194/0x22c
    f2fs_put_super+0x11c/0x1e8
    generic_shutdown_super+0x70/0xf4
    kill_block_super+0x2c/0x5c
    kill_f2fs_super+0x44/0x50
    deactivate_locked_super+0x60/0x8c
    deactivate_super+0x68/0x74
    cleanup_mnt+0x40/0x78
    
    Fix this by moving f2fs_destroy_stats() further below iput() in
    both f2fs_put_super() and f2fs_fill_super() paths.
    Signed-off-by: NSahitya Tummala <stummala@codeaurora.org>
    Reviewed-by: NChao Yu <yuchao0@huawei.com>
    Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: NSasha Levin <sashal@kernel.org>
    69e7f877
super.c 83.9 KB