lkml.org 
[lkml]   [2017]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] f2fs: prevent waiter encountering incorrect discard states
Date
In f2fs_submit_discard_endio, we will wake up waiter before setting
discard command states, so waiter may use incorrect states. Change
the order between complete() and states setting to fix this issue.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
---
v2: use wait_for_completion_io before releasing discard entry to avoid
use-after-free.
fs/f2fs/segment.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 24911c5679d6..ec19cfcfcd24 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
{
struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;

- complete(&dc->wait);
dc->error = bio->bi_error;
dc->state = D_DONE;
+ complete(&dc->wait);
bio_put(bio);
}

@@ -807,8 +807,7 @@ void f2fs_wait_discard_bio(struct f2fs_sb_info *sbi, block_t blkaddr)

list_for_each_entry_safe(dc, tmp, wait_list, list) {
if (dc->lstart <= blkaddr && blkaddr < dc->lstart + dc->len) {
- if (dc->state == D_SUBMIT)
- wait_for_completion_io(&dc->wait);
+ wait_for_completion_io(&dc->wait);
__punch_discard_cmd(sbi, dc, blkaddr);
}
}
@@ -868,8 +867,10 @@ static int issue_discard_thread(void *data)
blk_finish_plug(&plug);

list_for_each_entry_safe(dc, tmp, wait_list, list) {
- if (dc->state == D_DONE)
+ if (dc->state == D_DONE) {
+ wait_for_completion_io(&dc->wait);
__remove_discard_cmd(sbi, dc);
+ }
}
mutex_unlock(&dcc->cmd_lock);

--
2.12.2.510.ge1104a5ee539
\
 
 \ /
  Last update: 2017-04-05 12:29    [W:0.048 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site