Commit 5eba8c5d authored by Jaegeuk Kim's avatar Jaegeuk Kim
Browse files

f2fs: fix to access nullified flush_cmd_control pointer 



f2fs_sync_file()             remount_ro
 - f2fs_readonly
                               - destroy_flush_cmd_control
 - f2fs_issue_flush
   - no fcc pointer!

So, this patch doesn't free fcc in this case, but just stop its kernel thread
which sends flush commands.

Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent a2125ff7

fs/f2fs/f2fs.h

+1 −1
Original line number Diff line number Diff line
@@ -2103,7 +2103,7 @@ void f2fs_balance_fs(struct f2fs_sb_info *, bool); 
void f2fs_balance_fs_bg(struct f2fs_sb_info *);

int f2fs_issue_flush(struct f2fs_sb_info *);

int create_flush_cmd_control(struct f2fs_sb_info *);

void destroy_flush_cmd_control(struct f2fs_sb_info *);

void destroy_flush_cmd_control(struct f2fs_sb_info *, bool);

void invalidate_blocks(struct f2fs_sb_info *, block_t);

bool is_checkpointed_data(struct f2fs_sb_info *, block_t);

void refresh_sit_entry(struct f2fs_sb_info *, block_t, block_t);

fs/f2fs/segment.c

+25 −8
Original line number Diff line number Diff line
@@ -489,8 +489,13 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi) 
	if (!fcc->dispatch_list)

		wake_up(&fcc->flush_wait_queue);



	if (fcc->f2fs_issue_flush) {

		wait_for_completion(&cmd.wait);

		atomic_dec(&fcc->submit_flush);

	} else {

		llist_del_all(&fcc->issue_list);

		atomic_set(&fcc->submit_flush, 0);

	}



	return cmd.ret;

}
@@ -501,6 +506,11 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi) 
	struct flush_cmd_control *fcc;

	int err = 0;



	if (SM_I(sbi)->cmd_control_info) {

		fcc = SM_I(sbi)->cmd_control_info;

		goto init_thread;

	}



	fcc = kzalloc(sizeof(struct flush_cmd_control), GFP_KERNEL);

	if (!fcc)

		return -ENOMEM;
@@ -508,6 +518,7 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi) 
	init_waitqueue_head(&fcc->flush_wait_queue);

	init_llist_head(&fcc->issue_list);

	SM_I(sbi)->cmd_control_info = fcc;

init_thread:

	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,

				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));

	if (IS_ERR(fcc->f2fs_issue_flush)) {
@@ -520,15 +531,21 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi) 
	return err;

}



void destroy_flush_cmd_control(struct f2fs_sb_info *sbi)

void destroy_flush_cmd_control(struct f2fs_sb_info *sbi, bool free)

{

	struct flush_cmd_control *fcc = SM_I(sbi)->cmd_control_info;



	if (fcc && fcc->f2fs_issue_flush)

		kthread_stop(fcc->f2fs_issue_flush);

	if (fcc && fcc->f2fs_issue_flush) {

		struct task_struct *flush_thread = fcc->f2fs_issue_flush;



		fcc->f2fs_issue_flush = NULL;

		kthread_stop(flush_thread);

	}

	if (free) {

		kfree(fcc);

		SM_I(sbi)->cmd_control_info = NULL;

	}

}



static void __locate_dirty_segment(struct f2fs_sb_info *sbi, unsigned int segno,

		enum dirty_type dirty_type)
@@ -2738,7 +2755,7 @@ void destroy_segment_manager(struct f2fs_sb_info *sbi) 


	if (!sm_info)

		return;

	destroy_flush_cmd_control(sbi);

	destroy_flush_cmd_control(sbi, true);

	destroy_dirty_segmap(sbi);

	destroy_curseg(sbi);

	destroy_free_segmap(sbi);

fs/f2fs/super.c

+3 −2
Original line number Diff line number Diff line
@@ -1102,8 +1102,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data) 
	 * or if flush_merge is not passed in mount option.

	 */

	if ((*flags & MS_RDONLY) || !test_opt(sbi, FLUSH_MERGE)) {

		destroy_flush_cmd_control(sbi);

	} else if (!SM_I(sbi)->cmd_control_info) {

		clear_opt(sbi, FLUSH_MERGE);

		destroy_flush_cmd_control(sbi, false);

	} else {

		err = create_flush_cmd_control(sbi);

		if (err)

			goto restore_gc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE