tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

In f2fs_sbi_show(), the extension_list, extension_count and
hot_ext_count are read without holding sbi->sb_lock. If a concurrent
sysfs store modifies the extension list via f2fs_update_extension_list(),
the show path may read inconsistent count and array contents, potentially
leading to out-of-bounds access or displaying stale data.

Fix this by holding sb_lock around the entire extension list read
and format operation.

Fixes: b6a06cbbb5f7 ("f2fs: support hot file extension")
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

authored by

Yongpeng Yang and committed by
Jaegeuk Kim 5909bedb b8b902fd

+5 -2
+5 -2
fs/f2fs/sysfs.c
··· 387 387 if (!strcmp(a->attr.name, "extension_list")) { 388 388 __u8 (*extlist)[F2FS_EXTENSION_LEN] = 389 389 sbi->raw_super->extension_list; 390 - int cold_count = le32_to_cpu(sbi->raw_super->extension_count); 391 - int hot_count = sbi->raw_super->hot_ext_count; 390 + int cold_count, hot_count; 392 391 int len = 0, i; 393 392 393 + f2fs_down_read(&sbi->sb_lock); 394 + cold_count = le32_to_cpu(sbi->raw_super->extension_count); 395 + hot_count = sbi->raw_super->hot_ext_count; 394 396 len += sysfs_emit_at(buf, len, "cold file extension:\n"); 395 397 for (i = 0; i < cold_count; i++) 396 398 len += sysfs_emit_at(buf, len, "%s\n", extlist[i]); ··· 400 398 len += sysfs_emit_at(buf, len, "hot file extension:\n"); 401 399 for (i = cold_count; i < cold_count + hot_count; i++) 402 400 len += sysfs_emit_at(buf, len, "%s\n", extlist[i]); 401 + f2fs_up_read(&sbi->sb_lock); 403 402 404 403 return len; 405 404 }