From: sunshijie via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>
To: jaegeuk@kernel.org, chao@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: sunshijie <sunshijie@xiaomi.com>
Subject: [f2fs-dev] [PATCH] f2fs: fix panic in f2fs_put_super
Date: Thu, 16 May 2024 16:40:56 +0800 [thread overview]
Message-ID: <20240516084056.1081148-1-sunshijie@xiaomi.com> (raw)
When thread A calls kill_f2fs_super, thread A may submit a bio to the function iput(sbi->node_inode);
Then thread A enters the process D state, and thread B may also call kill_f2fs_super and execute the code sbi->node_inode = NULL;
Now that the bio submitted by thread A is complete, it calls f2fs_write_end_io and may trigger null-ptr-deref in NODE_MAPPING.
Thread A Thread B IRQ context
- f2fs_put_super
- iput(sbi->node_inode)
- iput_final
- write_inode_now
- writeback_single_inode
- __writeback_single_inode
- filemap_fdatawait
- filemap_fdatawait_range
- __kcfi_typeid_free_transhuge_page
- __filemap_fdatawait_range
- wait_on_page_writeback
- folio_wait_writeback
- folio_wait_bit
- folio_wait_bit_common
- io_schedule
- f2fs_put_super
- sbi->node_inode = NULL
- __handle_irq_event_percpu
- ufs_qcom_mcq_esi_handler
- ufshcd_mcq_poll_cqe_nolock
- ufshcd_compl_one_cqe
- scsi_done
- scsi_done_internal
- blk_mq_complete_request
- scsi_complete
- scsi_finish_command
- scsi_io_completion
- scsi_end_request
- blk_update_request
- bio_endio
- f2fs_write_end_io
- NODE_MAPPING(sbi)
Signed-off-by: sunshijie <sunshijie@xiaomi.com>
---
fs/f2fs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index a4bc26dfdb1a..adffc9b80a9c 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1618,7 +1618,6 @@ static void f2fs_put_super(struct super_block *sb)
f2fs_release_ino_entry(sbi, true);
f2fs_leave_shrinker(sbi);
- mutex_unlock(&sbi->umount_mutex);
/* our cp_error case, we can wait for any writeback page */
f2fs_flush_merged_writes(sbi);
@@ -1648,6 +1647,8 @@ static void f2fs_put_super(struct super_block *sb)
iput(sbi->meta_inode);
sbi->meta_inode = NULL;
+ mutex_unlock(&sbi->umount_mutex);
+
/*
* iput() can update stat information, if f2fs_write_checkpoint()
* above failed with error.
--
2.34.1
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next reply other threads:[~2024-05-16 10:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-16 8:40 sunshijie via Linux-f2fs-devel [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-05-16 8:55 [f2fs-dev] [PATCH] f2fs: fix panic in f2fs_put_super sunshijie via Linux-f2fs-devel
2024-05-16 9:32 ` Chao Yu
2024-05-16 10:13 sunshijie via Linux-f2fs-devel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240516084056.1081148-1-sunshijie@xiaomi.com \
--to=linux-f2fs-devel@lists.sourceforge.net \
--cc=chao@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sunshijie@xiaomi.com \
--cc=sunshijie@xiaomi.corp-partner.google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).