Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1610171 > unrolled thread

Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard states

Started byJaegeuk Kim <jaegeuk@kernel.org>
First post2017-03-28 02:00 +0200
Last post2017-04-05 12:30 +0200
Articles 5 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard  states Jaegeuk Kim <jaegeuk@kernel.org> - 2017-03-28 02:00 +0200
    Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard  states Chao Yu <yuchao0@huawei.com> - 2017-03-28 03:20 +0200
      Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard  states Chao Yu <yuchao0@huawei.com> - 2017-04-01 09:00 +0200
        Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard  states Jaegeuk Kim <jaegeuk@kernel.org> - 2017-04-03 19:50 +0200
          Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard  states Chao Yu <yuchao0@huawei.com> - 2017-04-05 12:30 +0200

#1610171 — Re: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard states

FromJaegeuk Kim <jaegeuk@kernel.org>
Date2017-03-28 02:00 +0200
SubjectRe: [PATCH 3/3] f2fs: prevent waiter encountering incorrect discard states
Message-ID<tpMIi-7o5-3@gated-at.bofh.it>
On 03/27, Chao Yu wrote:
> In f2fs_submit_discard_endio, we will wake up waiter before setting
> discard command states, so waiter may use incorrect states. Change
> the order between complete() and states setting to fix this issue.
> 
> Signed-off-by: Chao Yu <yuchao0@huawei.com>
> ---
>  fs/f2fs/segment.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
> index 57a81f9c8c14..9f9542c9fe47 100644
> --- a/fs/f2fs/segment.c
> +++ b/fs/f2fs/segment.c
> @@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
>  {
>  	struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
>  
> -	complete(&dc->wait);
>  	dc->error = bio->bi_error;
>  	dc->state = D_DONE;
> +	complete(&dc->wait);

If we set D_DONE first, the object can be released by __remove_discard_cmd()?

Thanks,

>  	bio_put(bio);
>  }
>  
> -- 
> 2.8.2.295.g3f1c1d0

[toc] | [next] | [standalone]

#1610227

FromChao Yu <yuchao0@huawei.com>
Date2017-03-28 03:20 +0200
Message-ID<tpNXI-8w9-15@gated-at.bofh.it>
In reply to#1610171
On 2017/3/28 7:56, Jaegeuk Kim wrote:
> On 03/27, Chao Yu wrote:
>> In f2fs_submit_discard_endio, we will wake up waiter before setting
>> discard command states, so waiter may use incorrect states. Change
>> the order between complete() and states setting to fix this issue.
>>
>> Signed-off-by: Chao Yu <yuchao0@huawei.com>
>> ---
>>  fs/f2fs/segment.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
>> index 57a81f9c8c14..9f9542c9fe47 100644
>> --- a/fs/f2fs/segment.c
>> +++ b/fs/f2fs/segment.c
>> @@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
>>  {
>>  	struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
>>  
>> -	complete(&dc->wait);
>>  	dc->error = bio->bi_error;
>>  	dc->state = D_DONE;
>> +	complete(&dc->wait);
> 
> If we set D_DONE first, the object can be released by __remove_discard_cmd()?

Yes, I think so.

Thanks,

> 
> Thanks,
> 
>>  	bio_put(bio);
>>  }
>>  
>> -- 
>> 2.8.2.295.g3f1c1d0
> 
> .
>

[toc] | [prev] | [next] | [standalone]

#1614404

FromChao Yu <yuchao0@huawei.com>
Date2017-04-01 09:00 +0200
Message-ID<trlaV-7ve-5@gated-at.bofh.it>
In reply to#1610227
Ping,

Any problem here?

Thanks,

On 2017/3/28 9:17, Chao Yu wrote:
> On 2017/3/28 7:56, Jaegeuk Kim wrote:
>> On 03/27, Chao Yu wrote:
>>> In f2fs_submit_discard_endio, we will wake up waiter before setting
>>> discard command states, so waiter may use incorrect states. Change
>>> the order between complete() and states setting to fix this issue.
>>>
>>> Signed-off-by: Chao Yu <yuchao0@huawei.com>
>>> ---
>>>  fs/f2fs/segment.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
>>> index 57a81f9c8c14..9f9542c9fe47 100644
>>> --- a/fs/f2fs/segment.c
>>> +++ b/fs/f2fs/segment.c
>>> @@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
>>>  {
>>>  	struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
>>>  
>>> -	complete(&dc->wait);
>>>  	dc->error = bio->bi_error;
>>>  	dc->state = D_DONE;
>>> +	complete(&dc->wait);
>>
>> If we set D_DONE first, the object can be released by __remove_discard_cmd()?
> 
> Yes, I think so.
> 
> Thanks,
> 
>>
>> Thanks,
>>
>>>  	bio_put(bio);
>>>  }
>>>  
>>> -- 
>>> 2.8.2.295.g3f1c1d0
>>
>> .
>>

[toc] | [prev] | [next] | [standalone]

#1615447

FromJaegeuk Kim <jaegeuk@kernel.org>
Date2017-04-03 19:50 +0200
Message-ID<tseh4-1yt-17@gated-at.bofh.it>
In reply to#1614404
On 04/01, Chao Yu wrote:
> Ping,
> 
> Any problem here?
> 
> Thanks,
> 
> On 2017/3/28 9:17, Chao Yu wrote:
> > On 2017/3/28 7:56, Jaegeuk Kim wrote:
> >> On 03/27, Chao Yu wrote:
> >>> In f2fs_submit_discard_endio, we will wake up waiter before setting
> >>> discard command states, so waiter may use incorrect states. Change
> >>> the order between complete() and states setting to fix this issue.
> >>>
> >>> Signed-off-by: Chao Yu <yuchao0@huawei.com>
> >>> ---
> >>>  fs/f2fs/segment.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
> >>> index 57a81f9c8c14..9f9542c9fe47 100644
> >>> --- a/fs/f2fs/segment.c
> >>> +++ b/fs/f2fs/segment.c
> >>> @@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
> >>>  {
> >>>  	struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
> >>>  
> >>> -	complete(&dc->wait);
> >>>  	dc->error = bio->bi_error;
> >>>  	dc->state = D_DONE;
> >>> +	complete(&dc->wait);
> >>
> >> If we set D_DONE first, the object can be released by __remove_discard_cmd()?

What I mean was about use-after-free.

Thanks,

> > 
> > Yes, I think so.
> > 
> > Thanks,
> > 
> >>
> >> Thanks,
> >>
> >>>  	bio_put(bio);
> >>>  }
> >>>  
> >>> -- 
> >>> 2.8.2.295.g3f1c1d0
> >>
> >> .
> >>

[toc] | [prev] | [next] | [standalone]

#1616807

FromChao Yu <yuchao0@huawei.com>
Date2017-04-05 12:30 +0200
Message-ID<tsQmn-1oW-33@gated-at.bofh.it>
In reply to#1615447
On 2017/4/4 1:40, Jaegeuk Kim wrote:
> On 04/01, Chao Yu wrote:
>> Ping,
>>
>> Any problem here?
>>
>> Thanks,
>>
>> On 2017/3/28 9:17, Chao Yu wrote:
>>> On 2017/3/28 7:56, Jaegeuk Kim wrote:
>>>> On 03/27, Chao Yu wrote:
>>>>> In f2fs_submit_discard_endio, we will wake up waiter before setting
>>>>> discard command states, so waiter may use incorrect states. Change
>>>>> the order between complete() and states setting to fix this issue.
>>>>>
>>>>> Signed-off-by: Chao Yu <yuchao0@huawei.com>
>>>>> ---
>>>>>  fs/f2fs/segment.c | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
>>>>> index 57a81f9c8c14..9f9542c9fe47 100644
>>>>> --- a/fs/f2fs/segment.c
>>>>> +++ b/fs/f2fs/segment.c
>>>>> @@ -717,9 +717,9 @@ static void f2fs_submit_discard_endio(struct bio *bio)
>>>>>  {
>>>>>  	struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
>>>>>  
>>>>> -	complete(&dc->wait);
>>>>>  	dc->error = bio->bi_error;
>>>>>  	dc->state = D_DONE;
>>>>> +	complete(&dc->wait);
>>>>
>>>> If we set D_DONE first, the object can be released by __remove_discard_cmd()?
> 
> What I mean was about use-after-free.

I updated the patch, could you help to review it?

Thanks,

> 
> Thanks,
> 
>>>
>>> Yes, I think so.
>>>
>>> Thanks,
>>>
>>>>
>>>> Thanks,
>>>>
>>>>>  	bio_put(bio);
>>>>>  }
>>>>>  
>>>>> -- 
>>>>> 2.8.2.295.g3f1c1d0
>>>>
>>>> .
>>>>
> 
> .
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web