mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 10:40:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

f2fs: fix to access nullified flush_cmd_control pointer

Browse source 
f2fs_sync_file()             remount_ro
 - f2fs_readonly
                               - destroy_flush_cmd_control
 - f2fs_issue_flush
   - no fcc pointer!

So, this patch doesn't free fcc in this case, but just stop its kernel thread
which sends flush commands.

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
This commit is contained in:
Jaegeuk Kim 2016-12-07 16:23:32 -08:00
parent a2125ff7dd
commit 5eba8c5d1f
3 changed files with 29 additions and 11 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
fs/f2fs/f2fs.h
View file

@ -2103,7 +2103,7 @@ void f2fs_balance_fs(struct f2fs_sb_info *, bool);
void f2fs_balance_fs_bg(struct f2fs_sb_info *); void f2fs_balance_fs_bg(struct f2fs_sb_info *);
int f2fs_issue_flush(struct f2fs_sb_info *); int f2fs_issue_flush(struct f2fs_sb_info *);
int create_flush_cmd_control(struct f2fs_sb_info *); int create_flush_cmd_control(struct f2fs_sb_info *);
void destroy_flush_cmd_control(struct f2fs_sb_info *); void destroy_flush_cmd_control(struct f2fs_sb_info *, bool);
void invalidate_blocks(struct f2fs_sb_info *, block_t); void invalidate_blocks(struct f2fs_sb_info *, block_t);
bool is_checkpointed_data(struct f2fs_sb_info *, block_t); bool is_checkpointed_data(struct f2fs_sb_info *, block_t);
void refresh_sit_entry(struct f2fs_sb_info *, block_t, block_t); void refresh_sit_entry(struct f2fs_sb_info *, block_t, block_t);

33
fs/f2fs/segment.c
View file

@ -489,8 +489,13 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi)
if (!fcc->dispatch_list) if (!fcc->dispatch_list)
wake_up(&fcc->flush_wait_queue); wake_up(&fcc->flush_wait_queue);
wait_for_completion(&cmd.wait); if (fcc->f2fs_issue_flush) {
atomic_dec(&fcc->submit_flush); wait_for_completion(&cmd.wait);
atomic_dec(&fcc->submit_flush);
} else {
llist_del_all(&fcc->issue_list);
atomic_set(&fcc->submit_flush, 0);
}
return cmd.ret; return cmd.ret;
} }
@ -501,6 +506,11 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
struct flush_cmd_control *fcc; struct flush_cmd_control *fcc;
int err = 0; int err = 0;
if (SM_I(sbi)->cmd_control_info) {
fcc = SM_I(sbi)->cmd_control_info;
goto init_thread;
}
fcc = kzalloc(sizeof(struct flush_cmd_control), GFP_KERNEL); fcc = kzalloc(sizeof(struct flush_cmd_control), GFP_KERNEL);
if (!fcc) if (!fcc)
return -ENOMEM; return -ENOMEM;
@ -508,6 +518,7 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
init_waitqueue_head(&fcc->flush_wait_queue); init_waitqueue_head(&fcc->flush_wait_queue);
init_llist_head(&fcc->issue_list); init_llist_head(&fcc->issue_list);
SM_I(sbi)->cmd_control_info = fcc; SM_I(sbi)->cmd_control_info = fcc;
init_thread:
fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi, fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev)); "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
if (IS_ERR(fcc->f2fs_issue_flush)) { if (IS_ERR(fcc->f2fs_issue_flush)) {
@ -520,14 +531,20 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
return err; return err;
} }
void destroy_flush_cmd_control(struct f2fs_sb_info *sbi) void destroy_flush_cmd_control(struct f2fs_sb_info *sbi, bool free)
{ {
struct flush_cmd_control *fcc = SM_I(sbi)->cmd_control_info; struct flush_cmd_control *fcc = SM_I(sbi)->cmd_control_info;
if (fcc && fcc->f2fs_issue_flush) if (fcc && fcc->f2fs_issue_flush) {
kthread_stop(fcc->f2fs_issue_flush); struct task_struct *flush_thread = fcc->f2fs_issue_flush;
kfree(fcc);
SM_I(sbi)->cmd_control_info = NULL; fcc->f2fs_issue_flush = NULL;
kthread_stop(flush_thread);
}
if (free) {
kfree(fcc);
SM_I(sbi)->cmd_control_info = NULL;
}
} }
static void __locate_dirty_segment(struct f2fs_sb_info *sbi, unsigned int segno, static void __locate_dirty_segment(struct f2fs_sb_info *sbi, unsigned int segno,
@ -2738,7 +2755,7 @@ void destroy_segment_manager(struct f2fs_sb_info *sbi)
if (!sm_info) if (!sm_info)
return; return;
destroy_flush_cmd_control(sbi); destroy_flush_cmd_control(sbi, true);
destroy_dirty_segmap(sbi); destroy_dirty_segmap(sbi);
destroy_curseg(sbi); destroy_curseg(sbi);
destroy_free_segmap(sbi); destroy_free_segmap(sbi);

5
fs/f2fs/super.c
View file

@ -1102,8 +1102,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
* or if flush_merge is not passed in mount option. * or if flush_merge is not passed in mount option.
*/ */
if ((*flags & MS_RDONLY) || !test_opt(sbi, FLUSH_MERGE)) { if ((*flags & MS_RDONLY) || !test_opt(sbi, FLUSH_MERGE)) {
destroy_flush_cmd_control(sbi); clear_opt(sbi, FLUSH_MERGE);
} else if (!SM_I(sbi)->cmd_control_info) { destroy_flush_cmd_control(sbi, false);
} else {
err = create_flush_cmd_control(sbi); err = create_flush_cmd_control(sbi);
if (err) if (err)
goto restore_gc; goto restore_gc;