f2fs: fix to access nullified flush_cmd_control pointer

f2fs_sync_file()             remount_ro
 - f2fs_readonly
                               - destroy_flush_cmd_control
 - f2fs_issue_flush
   - no fcc pointer!

So, this patch doesn't free fcc in this case, but just stop its kernel thread
which sends flush commands.

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 35dbab157ec3f6e52d10c2534fa2bcf1f9aa5f1d..137bbf0ae4c68613c97b3a4b6fca8392fa8bc923 100644 (file)
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2103,7 +2103,7 @@ void f2fs_balance_fs(struct f2fs_sb_info *, bool);
 void f2fs_balance_fs_bg(struct f2fs_sb_info *);
 int f2fs_issue_flush(struct f2fs_sb_info *);
 int create_flush_cmd_control(struct f2fs_sb_info *);
-void destroy_flush_cmd_control(struct f2fs_sb_info *);
+void destroy_flush_cmd_control(struct f2fs_sb_info *, bool);
 void invalidate_blocks(struct f2fs_sb_info *, block_t);
 bool is_checkpointed_data(struct f2fs_sb_info *, block_t);
 void refresh_sit_entry(struct f2fs_sb_info *, block_t, block_t);

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 8affc56211814aaadf6639afb67cf126d6cebf85..d7d5727fe8b2613c6fe3a88f759de55fd0708d78 100644 (file)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -489,8 +489,13 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi)
        if (!fcc->dispatch_list)
                wake_up(&fcc->flush_wait_queue);
 
-       wait_for_completion(&cmd.wait);
-       atomic_dec(&fcc->submit_flush);
+       if (fcc->f2fs_issue_flush) {
+               wait_for_completion(&cmd.wait);
+               atomic_dec(&fcc->submit_flush);
+       } else {
+               llist_del_all(&fcc->issue_list);
+               atomic_set(&fcc->submit_flush, 0);
+       }
 
        return cmd.ret;
 }
@@ -501,6 +506,11 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
        struct flush_cmd_control *fcc;
        int err = 0;
 
+       if (SM_I(sbi)->cmd_control_info) {
+               fcc = SM_I(sbi)->cmd_control_info;
+               goto init_thread;
+       }
+
        fcc = kzalloc(sizeof(struct flush_cmd_control), GFP_KERNEL);
        if (!fcc)
                return -ENOMEM;
@@ -508,6 +518,7 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
        init_waitqueue_head(&fcc->flush_wait_queue);
        init_llist_head(&fcc->issue_list);
        SM_I(sbi)->cmd_control_info = fcc;
+init_thread:
        fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
                                "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
        if (IS_ERR(fcc->f2fs_issue_flush)) {
@@ -520,14 +531,20 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
        return err;
 }
 
-void destroy_flush_cmd_control(struct f2fs_sb_info *sbi)
+void destroy_flush_cmd_control(struct f2fs_sb_info *sbi, bool free)
 {
        struct flush_cmd_control *fcc = SM_I(sbi)->cmd_control_info;
 
-       if (fcc && fcc->f2fs_issue_flush)
-               kthread_stop(fcc->f2fs_issue_flush);
-       kfree(fcc);
-       SM_I(sbi)->cmd_control_info = NULL;
+       if (fcc && fcc->f2fs_issue_flush) {
+               struct task_struct *flush_thread = fcc->f2fs_issue_flush;
+
+               fcc->f2fs_issue_flush = NULL;
+               kthread_stop(flush_thread);
+       }
+       if (free) {
+               kfree(fcc);
+               SM_I(sbi)->cmd_control_info = NULL;
+       }
 }
 
 static void __locate_dirty_segment(struct f2fs_sb_info *sbi, unsigned int segno,
@@ -2738,7 +2755,7 @@ void destroy_segment_manager(struct f2fs_sb_info *sbi)
 
        if (!sm_info)
                return;
-       destroy_flush_cmd_control(sbi);
+       destroy_flush_cmd_control(sbi, true);
        destroy_dirty_segmap(sbi);
        destroy_curseg(sbi);
        destroy_free_segmap(sbi);

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 1a526474b3321c6e46739f54cefe83dba93aaac8..b62c10d28e0652fd4a0d45d19d006e42a2cd4d8a 100644 (file)
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1102,8 +1102,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
         * or if flush_merge is not passed in mount option.
         */
        if ((*flags & MS_RDONLY) || !test_opt(sbi, FLUSH_MERGE)) {
-               destroy_flush_cmd_control(sbi);
-       } else if (!SM_I(sbi)->cmd_control_info) {
+               clear_opt(sbi, FLUSH_MERGE);
+               destroy_flush_cmd_control(sbi, false);
+       } else {
                err = create_flush_cmd_control(sbi);
                if (err)
                        goto restore_gc;