github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

f2fs: cache: pin cached block in f2fs_end_cache_writeback()

Browse Source 
Like page cache folios, writeback does not hold an active reference on
the cached block during I/O flight, relying instead on truncation or
shrinker callers to wait on F2FS_BLOCK_WRITEBACK before releasing the entry.

However, in f2fs_end_cache_writeback(), clear_and_wake_up_bit() executes
two distinct steps:
1. clear_bit_unlock(F2FS_BLOCK_WRITEBACK, &entry->state): clears the bit.
2. wake_up_bit(&entry->state, F2FS_BLOCK_WRITEBACK): hashes &entry->state
   to look up the waitqueue and wakes waiting tasks.

Once step 1 clears the bit, a concurrent waiter in f2fs_do_truncate_cache()
or f2fs_do_shrink_cache() is immediately unblocked. The waiter can proceed
to delete the entry from the radix tree, drop the final reference, and
kfree() the entry before step 2 finishes, causing wake_up_bit() to access
freed memory:

CPU 0 (I/O completion)               CPU 1 (Truncation / Shrinker)
- f2fs_cache_write_end_io()
 - f2fs_end_cache_writeback(entry)
  - clear_and_wake_up_bit()
   - clear_bit_unlock(WRITEBACK)
   : bit is cleared!
                                     - f2fs_do_truncate_cache(entry)
                                      - f2fs_cache_wait_writeback(entry)
                                      : sees WRITEBACK cleared!
                                      - radix_tree_delete(&cache->root, ...)
                                      - f2fs_put_cache(entry, true)
                                       - atomic_dec_and_test(&refcount) == 0
                                       - f2fs_do_free_cache(entry)
                                        - kfree(entry->data);
                                        - kfree(entry); <--- FREED!
   - smp_mb__after_atomic()
   - wake_up_bit(&entry->state, ...)
   : Dereferences &entry->state on freed entry! (UAF)

Mirror the logic in folio_end_writeback() by acquiring a temporary reference
via f2fs_cache_get() before clear_and_wake_up_bit() and releasing it with
f2fs_cache_put() once wake_up_bit() completes. This guarantees the entry
can not be freed until wake_up_bit() has finished.

This fixes commit 399410a90ca7 ("f2fs: cache: implement metadata cache").

Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
This commit is contained in:
Chao Yu 2026-09-30 23:54:34 +00:00 committed by Jaegeuk Kim
parent 7566fec606
commit 6e392158cf
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/f2fs/cache.c
View File

@ -117,7 +117,15 @@ void f2fs_end_cache_writeback(struct f2fs_cached_block *entry)
*/ */
f2fs_cache_update_tag(entry, F2FS_CACHE_TAG_WRITEBACK, f2fs_cache_update_tag(entry, F2FS_CACHE_TAG_WRITEBACK,
F2FS_CACHE_TAG_NONE); F2FS_CACHE_TAG_NONE);
/*
* Writeback does not hold an entry reference of its own, relying
* on truncation to wait for the clearing of F2FS_BLOCK_WRITEBACK.
* But here we must make sure that the entry is not freed and
* reused before clear_and_wake_up_bit().
*/
f2fs_cache_get(entry);
clear_and_wake_up_bit(F2FS_BLOCK_WRITEBACK, &entry->state); clear_and_wake_up_bit(F2FS_BLOCK_WRITEBACK, &entry->state);
f2fs_cache_put(entry);
} }
static int f2fs_cache_refcount(struct f2fs_cached_block *entry) static int f2fs_cache_refcount(struct f2fs_cached_block *entry)