mirror of
https://github.com/torvalds/linux.git
synced 2024-12-04 18:13:04 +00:00
95978caa13
In compress cluster, if physical block number is less than logic
page number, race condition will cause use-after-free issue as
described below:
- f2fs_write_compressed_pages
- fio.page = cic->rpages[0];
- f2fs_outplace_write_data
- f2fs_compress_write_end_io
- kfree(cic->rpages);
- kfree(cic);
- fio.page = cic->rpages[1];
f2fs_write_multi_pages+0xfd0/0x1a98
f2fs_write_data_pages+0x74c/0xb5c
do_writepages+0x64/0x108
__writeback_single_inode+0xdc/0x4b8
writeback_sb_inodes+0x4d0/0xa68
__writeback_inodes_wb+0x88/0x178
wb_writeback+0x1f0/0x424
wb_workfn+0x2f4/0x574
process_one_work+0x210/0x48c
worker_thread+0x2e8/0x44c
kthread+0x110/0x120
ret_from_fork+0x10/0x18
Fixes:
|
||
|---|---|---|
| .. | ||
| acl.c | ||
| acl.h | ||
| checkpoint.c | ||
| compress.c | ||
| data.c | ||
| debug.c | ||
| dir.c | ||
| extent_cache.c | ||
| f2fs.h | ||
| file.c | ||
| gc.c | ||
| gc.h | ||
| hash.c | ||
| inline.c | ||
| inode.c | ||
| Kconfig | ||
| Makefile | ||
| namei.c | ||
| node.c | ||
| node.h | ||
| recovery.c | ||
| segment.c | ||
| segment.h | ||
| shrinker.c | ||
| super.c | ||
| sysfs.c | ||
| trace.c | ||
| trace.h | ||
| verity.c | ||
| xattr.c | ||
| xattr.h | ||