Merge "f2fs: fix use-after-free when accessing bio->bi_crypt_context" (b271780b) · Commits · e / devices / android_kernel_fairphone_FP5

fs/f2fs/data.c

+14 −9

Original line number	Diff line number	Diff line
		@@ -789,9 +789,10 @@ static void del_bio_entry(struct bio_entry *be)
		kmem_cache_free(bio_entry_slab, be);
		}

		static int add_ipu_page(struct f2fs_sb_info sbi, struct bio *bio,
		static int add_ipu_page(struct f2fs_io_info fio, struct bio *bio,
		struct page *page)
		{
		struct f2fs_sb_info *sbi = fio->sbi;
		enum temp_type temp;
		bool found = false;
		int ret = -EAGAIN;
		@@ -808,13 +809,19 @@ static int add_ipu_page(struct f2fs_sb_info sbi, struct bio *bio,

		found = true;

		if (bio_add_page(*bio, page, PAGE_SIZE, 0) ==
		f2fs_bug_on(sbi, !page_is_mergeable(sbi, *bio,
		*fio->last_block,
		fio->new_blkaddr));
		if (f2fs_crypt_mergeable_bio(*bio,
		fio->page->mapping->host,
		fio->page->index, fio) &&
		bio_add_page(*bio, page, PAGE_SIZE, 0) ==
		PAGE_SIZE) {
		ret = 0;
		break;
		}

		/* bio is full */
		/* page can't be merged into bio; submit the bio */
		del_bio_entry(be);
		__submit_bio(sbi, *bio, DATA);
		break;
		@@ -899,10 +906,8 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)
		trace_f2fs_submit_page_bio(page, fio);
		f2fs_trace_ios(fio, 0);

		if (bio && (!page_is_mergeable(fio->sbi, bio, *fio->last_block,
		fio->new_blkaddr) \|\|
		!f2fs_crypt_mergeable_bio(bio, fio->page->mapping->host,
		fio->page->index, fio)))
		if (bio && !page_is_mergeable(fio->sbi, bio, *fio->last_block,
		fio->new_blkaddr))
		f2fs_submit_merged_ipu_write(fio->sbi, &bio, NULL);
		alloc_new:
		if (!bio) {
		@@ -914,7 +919,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)

		add_bio_entry(fio->sbi, bio, page, fio->temp);
		} else {
		if (add_ipu_page(fio->sbi, &bio, page))
		if (add_ipu_page(fio, &bio, page))
		goto alloc_new;
		}