Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b096edf2 authored by Chao Yu's avatar Chao Yu Committed by Jaegeuk Kim
Browse files

f2fs: fix use-after-free of dicard command entry 



As Dan Carpenter reported:

The patch 20ee4382322c: "f2fs: issue small discard by LBA order" from
Jul 8, 2018, leads to the following Smatch warning:

	fs/f2fs/segment.c:1277 __issue_discard_cmd_orderly()
	warn: 'dc' was already freed.

See also:
fs/f2fs/segment.c:2550 __issue_discard_cmd_range() warn: 'dc' was already freed.

In order to fix this issue, let's get error from __submit_discard_cmd(),
and release current discard command after we referenced next one.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent 8bdb419b

fs/f2fs/segment.c

+45 −34
Original line number Diff line number Diff line
@@ -994,7 +994,7 @@ static void __update_discard_tree_range(struct f2fs_sb_info *sbi, 
				struct block_device *bdev, block_t lstart,

				block_t start, block_t len);

/* this function is copied from blkdev_issue_discard from block/blk-lib.c */

static void __submit_discard_cmd(struct f2fs_sb_info *sbi,

static int __submit_discard_cmd(struct f2fs_sb_info *sbi,

						struct discard_policy *dpolicy,

						struct discard_cmd *dc,

						unsigned int *issued)
@@ -1011,10 +1011,10 @@ static void __submit_discard_cmd(struct f2fs_sb_info *sbi, 
	int err = 0;



	if (dc->state != D_PREP)

		return;

		return 0;



	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))

		return;

		return 0;



	trace_f2fs_issue_discard(bdev, dc->start, dc->len);
@@ -1053,7 +1053,17 @@ static void __submit_discard_cmd(struct f2fs_sb_info *sbi, 
					SECTOR_FROM_BLOCK(len),

					GFP_NOFS, 0, &bio);

submit:

		if (!err && bio) {

		if (err) {

			spin_lock_irqsave(&dc->lock, flags);

			if (dc->state == D_PARTIAL)

				dc->state = D_SUBMIT;

			spin_unlock_irqrestore(&dc->lock, flags);



			break;

		}



		f2fs_bug_on(sbi, !bio);



		/*

		 * should keep before submission to avoid D_DONE

		 * right away
@@ -1081,15 +1091,6 @@ static void __submit_discard_cmd(struct f2fs_sb_info *sbi, 
		atomic_inc(&dcc->issued_discard);



		f2fs_update_iostat(sbi, FS_DISCARD, 1);

		} else {

			spin_lock_irqsave(&dc->lock, flags);

			if (dc->state == D_PARTIAL)

				dc->state = D_SUBMIT;

			spin_unlock_irqrestore(&dc->lock, flags);



			__remove_discard_cmd(sbi, dc);

			err = -EIO;

		}



		lstart += len;

		start += len;
@@ -1097,8 +1098,9 @@ static void __submit_discard_cmd(struct f2fs_sb_info *sbi, 
		len = total_len;

	}



	if (len)

	if (!err && len)

		__update_discard_tree_range(sbi, bdev, lstart, start, len);

	return err;

}



static struct discard_cmd *__insert_discard_tree(struct f2fs_sb_info *sbi,
@@ -1304,6 +1306,7 @@ static unsigned int __issue_discard_cmd_orderly(struct f2fs_sb_info *sbi, 


	while (dc) {

		struct rb_node *node;

		int err = 0;



		if (dc->state != D_PREP)

			goto next;
@@ -1314,12 +1317,14 @@ static unsigned int __issue_discard_cmd_orderly(struct f2fs_sb_info *sbi, 
		}



		dcc->next_pos = dc->lstart + dc->len;

		__submit_discard_cmd(sbi, dpolicy, dc, &issued);

		err = __submit_discard_cmd(sbi, dpolicy, dc, &issued);



		if (issued >= dpolicy->max_requests)

			break;

next:

		node = rb_next(&dc->rb_node);

		if (err)

			__remove_discard_cmd(sbi, dc);

		dc = rb_entry_safe(node, struct discard_cmd, rb_node);

	}
@@ -2571,6 +2576,7 @@ static unsigned int __issue_discard_cmd_range(struct f2fs_sb_info *sbi, 


	while (dc && dc->lstart <= end) {

		struct rb_node *node;

		int err = 0;



		if (dc->len < dpolicy->granularity)

			goto skip;
@@ -2580,11 +2586,14 @@ static unsigned int __issue_discard_cmd_range(struct f2fs_sb_info *sbi, 
			goto skip;

		}



		__submit_discard_cmd(sbi, dpolicy, dc, &issued);

		err = __submit_discard_cmd(sbi, dpolicy, dc, &issued);



		if (issued >= dpolicy->max_requests) {

			start = dc->lstart + dc->len;



			if (err)

				__remove_discard_cmd(sbi, dc);



			blk_finish_plug(&plug);

			mutex_unlock(&dcc->cmd_lock);

			trimmed += __wait_all_discard_cmd(sbi, NULL);
@@ -2593,6 +2602,8 @@ static unsigned int __issue_discard_cmd_range(struct f2fs_sb_info *sbi, 
		}

skip:

		node = rb_next(&dc->rb_node);

		if (err)

			__remove_discard_cmd(sbi, dc);

		dc = rb_entry_safe(node, struct discard_cmd, rb_node);



		if (fatal_signal_pending(current))