Long Li 7b0033dbc4 f2fs: fix race in concurrent f2fs_stop_gc_thread ... In my test case, concurrent calls to f2fs shutdown report the following stack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace: <TASK> ? show_regs+0x8b/0xa0 ? __die_body+0x26/0xa0 ? die_addr+0x54/0x90 ? exc_general_protection+0x24b/0x5c0 ? asm_exc_general_protection+0x26/0x30 ? kthread_stop+0x46/0x390 f2fs_stop_gc_thread+0x6c/0x110 f2fs_do_shutdown+0x309/0x3a0 f2fs_ioc_shutdown+0x150/0x1c0 __f2fs_ioctl+0xffd/0x2ac0 f2fs_ioctl+0x76/0xe0 vfs_ioctl+0x23/0x60 __x64_sys_ioctl+0xce/0xf0 x64_sys_call+0x2b1b/0x4540 do_syscall_64+0xa7/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e The root cause is a race condition in f2fs_stop_gc_thread() called from different f2fs shutdown paths: [CPU0] [CPU1] ---------------------- ----------------------- f2fs_stop_gc_thread f2fs_stop_gc_thread gc_th = sbi->gc_thread gc_th = sbi->gc_thread kfree(gc_th) sbi->gc_thread = NULL < gc_th != NULL > kthread_stop(gc_th->f2fs_gc_task) //UAF The commit c7f114d864 ("f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()") attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions. Fix it by converting to write lock of s_umount in f2fs_do_shutdown(). Fixes: 7950e9ac63 ("f2fs: stop gc/discard thread after fs shutdown") Signed-off-by: Long Li <leo.lilong@huawei.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>		2024-11-05 18:27:51 +00:00
..
acl.c	f2fs: Use struct_size() to improve f2fs_acl_clone()	2024-10-14 20:04:57 +00:00
acl.h	fs: port ->set_acl() to pass mnt_idmap	2023-01-19 09:24:27 +01:00
checkpoint.c	f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()	2024-11-01 01:24:41 +00:00
compress.c	f2fs: get rid of page->index	2024-09-06 23:04:48 +00:00
data.c	f2fs: fix fiemap failure issue when page size is 16KB	2024-11-05 18:26:51 +00:00
debug.c	f2fs: fix typos	2024-11-01 01:24:41 +00:00
dir.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
extent_cache.c	f2fs: introduce device aliasing file	2024-11-01 01:19:00 +00:00
f2fs.h	f2fs: clean up the unused variable additional_reserved_segments	2024-11-01 01:24:41 +00:00
file.c	f2fs: fix race in concurrent f2fs_stop_gc_thread	2024-11-05 18:27:51 +00:00
gc.c	f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID	2024-11-01 01:24:41 +00:00
gc.h	f2fs: decrease spare area for pinned files for zoned devices	2024-11-01 01:19:00 +00:00
hash.c	f2fs: don't use casefolded comparison for "." and ".."	2022-05-17 11:19:23 -07:00
inline.c	f2fs: convert f2fs_write_inline_data() to use folio	2024-09-06 23:04:47 +00:00
inode.c	f2fs: introduce device aliasing file	2024-11-01 01:19:00 +00:00
iostat.c	f2fs: add async reset zone command support	2023-06-12 13:04:09 -07:00
iostat.h	f2fs: use iostat_lat_type directly as a parameter in the iostat_update_and_unbind_ctx()	2023-02-07 10:39:28 -08:00
Kconfig	fs: add CONFIG_BUFFER_HEAD	2023-08-02 09:13:09 -06:00
Makefile
namei.c	f2fs: get rid of online repaire on corrupted directory	2024-09-11 03:30:27 +00:00
node.c	f2fs: clean up opened code w/ {get,set}_nid()	2024-11-01 01:24:41 +00:00
node.h	f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC	2024-02-27 09:41:12 -08:00
recovery.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
segment.c	f2fs: fix to convert log type to segment data type correctly	2024-11-01 01:24:42 +00:00
segment.h	f2fs: clean up the unused variable additional_reserved_segments	2024-11-01 01:24:41 +00:00
shrinker.c	f2fs: add block_age-based extent cache	2022-12-12 14:53:56 -08:00
super.c	f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()	2024-11-01 01:24:41 +00:00
sysfs.c	f2fs: clean up the unused variable additional_reserved_segments	2024-11-01 01:24:41 +00:00
verity.c	f2fs-6.12-rc1	2024-09-24 15:12:38 -07:00
xattr.c	f2fs: reduce expensive checkpoint trigger frequency	2024-08-15 15:26:39 +00:00
xattr.h	f2fs: move f2fs_xattr_handlers and f2fs_xattr_handler_map to .rodata	2023-10-09 16:24:18 +02:00