Re: [PATCH] f2fs: fix to avoid race during access gc_thread pointer

From: Jaegeuk Kim
Date: Mon May 07 2018 - 23:54:28 EST


On 05/08, Chao Yu wrote:
> Thread A Thread B
> - f2fs_remount
> - stop_gc_thread
> - f2fs_sbi_store
> sbi->gc_thread = NULL;
> access sbi->gc_thread->gc_*
>
> Previously, we allocate memory for sbi->gc_thread based on background
> gc thread mount option, the memory can be released if we turn off
> that mount option, but still there are several places access gc_thread
> pointer without considering race condition, result in NULL point
> dereference.
>
> In order to fix this issue, use sb->s_umount to exclude those operations.
>
> Signed-off-by: Chao Yu <yuchao0@xxxxxxxxxx>
> ---
> fs/f2fs/sysfs.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
> index f3c3fb4cbb0d..0aec4db7fa02 100644
> --- a/fs/f2fs/sysfs.c
> +++ b/fs/f2fs/sysfs.c
> @@ -179,6 +179,7 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
> unsigned long t;
> unsigned int *ui;
> ssize_t ret;
> + bool gc_entry = (a->struct_type == GC_THREAD);
>
> ptr = __struct_ptr(sbi, a->struct_type);

We need to cover __struct_ptr() here.

> if (!ptr)
> @@ -277,8 +278,14 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a,
> return count;
> }
>
> + if (gc_entry)
> + down_read(&sbi->sb->s_umount);
> +
> *ui = t;
>
> + if (gc_entry)
> + up_read(&sbi->sb->s_umount);
> +
> if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
> f2fs_reset_iostat(sbi);
> return count;
> --
> 2.17.0.391.g1f1cddd558b5