f2fs: fix use-after-free when accessing bio->bi_crypt_context
There could be a potential race between these two paths below,
leading to use-after-free when accessing  bio->bi_crypt_context.
f2fs_write_cache_pages
->f2fs_do_write_data_page on page#1
  ->f2fs_inplace_write_data
    ->f2fs_merge_page_bio
      ->add_bio_entry
->f2fs_do_write_data_page on page#2
  ->f2fs_inplace_write_data
    ->f2fs_merge_page_bio
      ->f2fs_crypt_mergeable_bio
        ->fscrypt_mergeable_bio
                                       f2fs_write_begin on page#1
                                       ->f2fs_wait_on_page_writeback
                                         ->f2fs_submit_merged_ipu_write
                                           ->__submit_bio
                                        The bio gets completed, calling
                                        bio_endio
                                        ->bio_uninit
                                          ->bio_crypt_free_ctx
          ->use-after-free issue
Fix this by moving f2fs_crypt_mergeable_bio() check within
add_ipu_page() so that it's done under bio_list_lock to prevent
the above race.
Change-Id: I0ea667d6c749f2db9aefd85924eb347504495ef0
Signed-off-by:  Sahitya Tummala <stummala@codeaurora.org>
Sahitya Tummala <stummala@codeaurora.org>
Loading
Please register or sign in to comment
