Syzbot reported a slab-use-after-free issue in f2fs_write_end_io(): BUG: KASAN: slab-use-after-free in f2fs_write_end_io+0x9b9/0xb60 Read of size 4 at addr ffff88804357d170 by task kworker/u4:4/45
The race condition occurs between the filesystem unmount path (kill_f2fs_super) and the asynchronous I/O completion handler (f2fs_write_end_io). When unmounting, kill_f2fs_super() frees the sbi structure. However, if the bio completion callback f2fs_write_end_io() is still running in softirq context, it may access sbi->cp_wait after sbi has been freed, causing a use-after-free. Fix this by calling synchronize_rcu() before kfree(sbi). Since bio completion callbacks run in softirq context, which is an implicit RCU read-side critical section, synchronize_rcu() ensures all in-flight callbacks have completed before we free sbi. Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug\?extid\=b4444e3c972a7a124187 Signed-off-by: Szymon Wilczek <[email protected]> --- v4: Removed f2fs_wait_on_all_pages() call as pointed out by Chao Yu that it accesses sbi->write_io which has already been freed in f2fs_put_super(). v3: Simplified to minimal fix - only super.c change with synchronize_rcu(), as pointed out by Chao Yu that data.c changes are not necessary since synchronize_rcu() alone guarantees sbi won't be freed before callbacks complete. v2: Add synchronize_rcu() to wait for softirq bio callbacks to complete. fs/f2fs/super.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index c4c225e09dc4..dfa3c76c6f2a 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -5454,6 +5454,7 @@ static void kill_f2fs_super(struct super_block *sb) kill_block_super(sb); /* Release block devices last, after fscrypt_destroy_keyring(). */ if (sbi) { + synchronize_rcu(); destroy_device_list(sbi); kfree(sbi); sb->s_fs_info = NULL; -- 2.52.0 _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
