From 6e392158cf549936b3bb8cfd560099f596934192 Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Wed, 30 Sep 2026 23:54:34 +0000 Subject: [PATCH] f2fs: cache: pin cached block in f2fs_end_cache_writeback() Like page cache folios, writeback does not hold an active reference on the cached block during I/O flight, relying instead on truncation or shrinker callers to wait on F2FS_BLOCK_WRITEBACK before releasing the entry. However, in f2fs_end_cache_writeback(), clear_and_wake_up_bit() executes two distinct steps: 1. clear_bit_unlock(F2FS_BLOCK_WRITEBACK, &entry->state): clears the bit. 2. wake_up_bit(&entry->state, F2FS_BLOCK_WRITEBACK): hashes &entry->state to look up the waitqueue and wakes waiting tasks. Once step 1 clears the bit, a concurrent waiter in f2fs_do_truncate_cache() or f2fs_do_shrink_cache() is immediately unblocked. The waiter can proceed to delete the entry from the radix tree, drop the final reference, and kfree() the entry before step 2 finishes, causing wake_up_bit() to access freed memory: CPU 0 (I/O completion) CPU 1 (Truncation / Shrinker) - f2fs_cache_write_end_io() - f2fs_end_cache_writeback(entry) - clear_and_wake_up_bit() - clear_bit_unlock(WRITEBACK) : bit is cleared! - f2fs_do_truncate_cache(entry) - f2fs_cache_wait_writeback(entry) : sees WRITEBACK cleared! - radix_tree_delete(&cache->root, ...) - f2fs_put_cache(entry, true) - atomic_dec_and_test(&refcount) == 0 - f2fs_do_free_cache(entry) - kfree(entry->data); - kfree(entry); <--- FREED! - smp_mb__after_atomic() - wake_up_bit(&entry->state, ...) : Dereferences &entry->state on freed entry! (UAF) Mirror the logic in folio_end_writeback() by acquiring a temporary reference via f2fs_cache_get() before clear_and_wake_up_bit() and releasing it with f2fs_cache_put() once wake_up_bit() completes. This guarantees the entry can not be freed until wake_up_bit() has finished. This fixes commit 399410a90ca7 ("f2fs: cache: implement metadata cache"). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim --- fs/f2fs/cache.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/f2fs/cache.c b/fs/f2fs/cache.c index 38fc5eb17f92..7831e53f5678 100644 --- a/fs/f2fs/cache.c +++ b/fs/f2fs/cache.c @@ -117,7 +117,15 @@ void f2fs_end_cache_writeback(struct f2fs_cached_block *entry) */ f2fs_cache_update_tag(entry, F2FS_CACHE_TAG_WRITEBACK, F2FS_CACHE_TAG_NONE); + /* + * Writeback does not hold an entry reference of its own, relying + * on truncation to wait for the clearing of F2FS_BLOCK_WRITEBACK. + * But here we must make sure that the entry is not freed and + * reused before clear_and_wake_up_bit(). + */ + f2fs_cache_get(entry); clear_and_wake_up_bit(F2FS_BLOCK_WRITEBACK, &entry->state); + f2fs_cache_put(entry); } static int f2fs_cache_refcount(struct f2fs_cached_block *entry)