f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()
authorChao Yu <chao@kernel.org>
Fri, 30 Dec 2022 15:43:32 +0000 (23:43 +0800)
committerJaegeuk Kim <jaegeuk@kernel.org>
Tue, 3 Jan 2023 16:58:47 +0000 (08:58 -0800)
commitb3d83066cbebc76dbac8a5fca931f64b4c6fff34
tree57451fcc1f4c9ffa446fb46a7916a406f615f708
parent69b41ac87e4a664de78a395ff97166f0b2943210
f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush()

With below two cases, it will cause NULL pointer dereference when
accessing SM_I(sbi)->fcc_info in f2fs_issue_flush().

a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will
release SM_I(sbi)->fcc_info,

- mount -o noflush_merge /dev/vda /mnt/f2fs
- mount -o remount,flush_merge /dev/vda /mnt/f2fs  -- kthread_run() fails
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync

b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below
testcase,

- mount -o ro /dev/vda /mnt/f2fs
- mount -o rw,remount /dev/vda /mnt/f2fs
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync

In order to fix this issue, let change as below:
- fix error path handling in f2fs_create_flush_cmd_control().
- allocate SM_I(sbi)->fcc_info even if readonly is on.

Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
fs/f2fs/segment.c