f2fs: fix to avoid race during access gc_thread pointer (250dbf51) · Commits · 戴 / test

Thread A Thread B - f2fs_remount - stop_gc_thread - f2fs_sbi_store sbi->gc_thread = NULL; access sbi->gc_thread->gc_* Previously, we allocate memory for sbi->gc_thread based on background gc thread mount option, the memory can be released if we turn off that mount option, but still there are several places access gc_thread pointer without considering race condition, result in NULL point dereference. In order to fix this issue, use sb->s_umount to exclude those operations. Signed-off-by:

Chao Yu <yuchao0@huawei.com> Signed-off-by:

Jaegeuk Kim <jaegeuk@kernel.org>

fs/f2fs/sysfs.c

+18 −1

Original line number	Diff line number	Diff line
		@@ -165,7 +165,7 @@ static ssize_t f2fs_sbi_show(struct f2fs_attr *a,
		return snprintf(buf, PAGE_SIZE, "%u\n", *ui);
		}

		static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
		static ssize_t __f2fs_sbi_store(struct f2fs_attr *a,
		struct f2fs_sb_info *sbi,
		const char *buf, size_t count)
		{
		@@ -278,6 +278,23 @@ out:
		return count;
		}

		static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
		struct f2fs_sb_info *sbi,
		const char *buf, size_t count)
		{
		ssize_t ret;
		bool gc_entry = (!strcmp(a->attr.name, "gc_urgent") \|\|
		a->struct_type == GC_THREAD);

		if (gc_entry)
		down_read(&sbi->sb->s_umount);
		ret = __f2fs_sbi_store(a, sbi, buf, count);
		if (gc_entry)
		up_read(&sbi->sb->s_umount);

		return ret;
		}

		static ssize_t f2fs_attr_show(struct kobject *kobj,
		struct attribute attr, char buf)
		{

Admin message