Merge "f2fs: fix use-after-free issue when accessing sbi->stat_info" (98d1a46b) · Commits · e / devices / android_kernel_oneplus_sm8150

fs/f2fs/super.c

+14 −11

Original line number	Diff line number	Diff line
		@@ -1034,9 +1034,6 @@ static void f2fs_put_super(struct super_block *sb)
		write_checkpoint(sbi, &cpc);
		}

		/* write_checkpoint can update stat informaion */
		f2fs_destroy_stats(sbi);

		/*
		* normally superblock is clean, so we need to release this.
		* In addition, EIO will skip do checkpoint, we need this as well.
		@@ -1052,6 +1049,12 @@ static void f2fs_put_super(struct super_block *sb)
		iput(sbi->node_inode);
		iput(sbi->meta_inode);

		/*
		* iput() can update stat information, if f2fs_write_checkpoint()
		* above failed with error.
		*/
		f2fs_destroy_stats(sbi);

		/* destroy f2fs internal modules */
		destroy_node_manager(sbi);
		destroy_segment_manager(sbi);
		@@ -2898,24 +2901,24 @@ static int f2fs_fill_super(struct super_block sb, void data, int silent)

		build_gc_manager(sbi);

		err = f2fs_build_stats(sbi);
		if (err)
		goto free_nm;

		/* get an inode for node space */
		sbi->node_inode = f2fs_iget(sb, F2FS_NODE_INO(sbi));
		if (IS_ERR(sbi->node_inode)) {
		f2fs_msg(sb, KERN_ERR, "Failed to read node inode");
		err = PTR_ERR(sbi->node_inode);
		goto free_nm;
		goto free_stats;
		}

		err = f2fs_build_stats(sbi);
		if (err)
		goto free_node_inode;

		/* read root inode and dentry */
		root = f2fs_iget(sb, F2FS_ROOT_INO(sbi));
		if (IS_ERR(root)) {
		f2fs_msg(sb, KERN_ERR, "Failed to read root inode");
		err = PTR_ERR(root);
		goto free_stats;
		goto free_node_inode;
		}
		if (!S_ISDIR(root->i_mode) \|\| !root->i_blocks \|\| !root->i_size) {
		iput(root);
		@@ -3043,12 +3046,12 @@ static int f2fs_fill_super(struct super_block sb, void data, int silent)
		free_root_inode:
		dput(sb->s_root);
		sb->s_root = NULL;
		free_stats:
		f2fs_destroy_stats(sbi);
		free_node_inode:
		release_ino_entry(sbi, true);
		truncate_inode_pages_final(NODE_MAPPING(sbi));
		iput(sbi->node_inode);
		free_stats:
		f2fs_destroy_stats(sbi);
		free_nm:
		destroy_node_manager(sbi);
		free_sm: