• Chao Yu's avatar
    f2fs: fix to avoid use-after-free in f2fs_write_multi_pages() · 95978caa
    Chao Yu authored
    In compress cluster, if physical block number is less than logic
    page number, race condition will cause use-after-free issue as
    described below:
    
    - f2fs_write_compressed_pages
     - fio.page = cic->rpages[0];
     - f2fs_outplace_write_data
    					- f2fs_compress_write_end_io
    					 - kfree(cic->rpages);
    					 - kfree(cic);
     - fio.page = cic->rpages[1];
    
    f2fs_write_multi_pages+0xfd0/0x1a98
    f2fs_write_data_pages+0x74c/0xb5c
    do_writepages+0x64/0x108
    __writeback_single_inode+0xdc/0x4b8
    writeback_sb_inodes+0x4d0/0xa68
    __writeback_inodes_wb+0x88/0x178
    wb_writeback+0x1f0/0x424
    wb_workfn+0x2f4/0x574
    process_one_work+0x210/0x48c
    worker_thread+0x2e8/0x44c
    kthread+0x110/0x120
    ret_from_fork+0x10/0x18
    
    Fixes: 4c8ff709 ("f2fs: support data compression")
    Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    95978caa
compress.c 26.3 KB