From 9bc7ed61dc0b83296b922367b46824b9445d4493 Mon Sep 17 00:00:00 2001 From: Sayali Lokhande Date: Thu, 29 Oct 2020 17:57:08 +0530 Subject: [PATCH] f2fs: Fix double free issue for s_encoding In case of error in fsync data recovery during mount, sb->s_encoding is freed but not set to NULL, resulting in double free issue in f2fs_put_super during unmount. Log: Object already free [ 1447.382542] INFO: Allocated in kvmalloc_node+0x58/0x9c age=351740 cpu=7 pid=695 [ 1447.382544] kvmalloc_node+0x58/0x9c [ 1447.382549] f2fs_build_node_manager+0x244/0x4f0 [ 1447.382554] f2fs_fill_super+0x14f4/0x1c04 [ 1447.382557] mount_bdev+0x178/0x1d8 [ 1447.382558] f2fs_mount+0x18/0x24 [ 1447.382562] legacy_get_tree+0x4c/0xac [ 1447.382563] vfs_get_tree+0x4c/0x118 [ 1447.382566] do_mount+0x678/0xcc4 [ 1447.382568] ksys_mount+0x98/0xdc <> [ 1447.382580] INFO: Freed in kvfree+0x38/0x44 age=16 cpu=7 pid=1 [ 1447.382582] kvfree+0x38/0x44 [ 1447.382584] f2fs_destroy_node_manager+0x2f4/0x38c [ 1447.382585] f2fs_put_super+0x198/0x2b4 [ 1447.382588] generic_shutdown_super+0x8c/0x140 [ 1447.382589] kill_block_super+0x20/0x50 [ 1447.382591] kill_f2fs_super+0xc0/0x108 [ 1447.382593] deactivate_locked_super+0x78/0x11c [ 1447.382595] deactivate_super+0x80/0xa4 [ 1447.382596] cleanup_mnt+0x11c/0x158 [ 1447.382598] __cleanup_mnt+0x14/0x20 This change sets s_encoding to NULL after its freed to avoid double free issue. Change-Id: I017ba5386e76c81d7e545d3eefc2ed02dc6522cc Signed-off-by: Sayali Lokhande --- fs/f2fs/super.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 9f38017239f3..2d1c83c14781 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1265,7 +1265,10 @@ static void f2fs_put_super(struct super_block *sb) for (i = 0; i < NR_PAGE_TYPE; i++) kvfree(sbi->write_io[i]); #ifdef CONFIG_UNICODE - utf8_unload(sb->s_encoding); + if (sb->s_encoding) { + utf8_unload(sb->s_encoding); + sb->s_encoding = NULL; + } #endif kvfree(sbi); } @@ -3842,7 +3845,10 @@ free_bio_info: kvfree(sbi->write_io[i]); #ifdef CONFIG_UNICODE - utf8_unload(sb->s_encoding); + if (sb->s_encoding) { + utf8_unload(sb->s_encoding); + sb->s_encoding = NULL; + } #endif free_options: #ifdef CONFIG_QUOTA