From nobody Sat Feb 7 09:16:51 2026 Received: from SHSQR01.spreadtrum.com (unknown [222.66.158.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D24CD2581 for ; Wed, 4 Jun 2025 05:56:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=222.66.158.135 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749016576; cv=none; b=Jv1YG2BI2K44ba5tdpsvOcqdtV7ZbXsvsNM7ZVfyacpxf1kcT1DYOsS8rmv3d3SK36ZvWbq8FxfIIbUxNPo+QdCcIHneX2eEWpgQ61ENQBwfEw/k4X5FQvtrqWfODDx1vFt+h6qU8OVbmnQbVE35/UGmprzWoCuneUqPqrOYhwg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749016576; c=relaxed/simple; bh=bouI8G1RCJFrYUxKLMlvgTppgPpvVWjm7uAA7NORbeQ=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=gfTOB0slpvVzY0GwAnH8iRsaqqzK1p7L0dRjG9wPTM4UY06N7lH6d+9p1JzfyNDJP2lteH5e0DNaNNiMMd0nD5whVkfKKM3TueNedKmQXb5XRj43a4e72crAP6CLq2OSFP7vRpxa3mpWTQIlGomgYSFzZPjQkbHAV2SEvuKMmcw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=unisoc.com; spf=pass smtp.mailfrom=unisoc.com; arc=none smtp.client-ip=222.66.158.135 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=unisoc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=unisoc.com Received: from SHSQR01.spreadtrum.com (localhost [127.0.0.2] (may be forged)) by SHSQR01.spreadtrum.com with ESMTP id 5545uAR6087460 for ; Wed, 4 Jun 2025 13:56:10 +0800 (+08) (envelope-from Zhiguo.Niu@unisoc.com) Received: from dlp.unisoc.com ([10.29.3.86]) by SHSQR01.spreadtrum.com with ESMTP id 5545tCa2081483; Wed, 4 Jun 2025 13:55:12 +0800 (+08) (envelope-from Zhiguo.Niu@unisoc.com) Received: from SHDLP.spreadtrum.com (bjmbx02.spreadtrum.com [10.0.64.8]) by dlp.unisoc.com (SkyGuard) with ESMTPS id 4bBxYb1T71z2Nr6MM; Wed, 4 Jun 2025 13:52:19 +0800 (CST) Received: from bj08434pcu.spreadtrum.com (10.0.73.87) by BJMBX02.spreadtrum.com (10.0.64.8) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Wed, 4 Jun 2025 13:55:09 +0800 From: Zhiguo Niu To: , CC: , , , , , , Subject: [PATCH] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic Date: Wed, 4 Jun 2025 13:54:52 +0800 Message-ID: <1749016492-31835-1-git-send-email-zhiguo.niu@unisoc.com> X-Mailer: git-send-email 1.9.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: SHCAS03.spreadtrum.com (10.0.1.207) To BJMBX02.spreadtrum.com (10.0.64.8) X-MAIL: SHSQR01.spreadtrum.com 5545tCa2081483 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic. The UAF case as below: Thread A Thread B - f2fs_decompress_end_io - f2fs_put_dic - queue_work add free_dic work to post_read_wq - do_unlink - iput - evict - call_rcu This file is deleted after read. Thread C kworker to process post_read_wq - rcu_do_batch - f2fs_free_inode - kmem_cache_free inode is freed by rcu - process_scheduled_works - f2fs_late_free_dic - f2fs_free_dic - f2fs_release_decomp_mem read (dic->inode)->i_compress_algorit= hm This patch increase inode->i_count before f2fs_free_dic and decrease it after free the dic. Cc: Daeho Jeong Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softi= rq") Signed-off-by: Zhiguo Niu Signed-off-by: Baocong Liu --- fs/f2fs/compress.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index b3c1df9..6b3b3a7 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -1687,7 +1687,7 @@ static void f2fs_release_decomp_mem(struct decompress= _io_ctx *dic, } =20 static void f2fs_free_dic(struct decompress_io_ctx *dic, - bool bypass_destroy_callback); + bool bypass_destroy_callback, bool late_free); =20 struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) { @@ -1743,12 +1743,12 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct com= press_ctx *cc) return dic; =20 out_free: - f2fs_free_dic(dic, true); + f2fs_free_dic(dic, true, false); return ERR_PTR(ret); } =20 static void f2fs_free_dic(struct decompress_io_ctx *dic, - bool bypass_destroy_callback) + bool bypass_destroy_callback, bool late_free) { int i; =20 @@ -1775,6 +1775,11 @@ static void f2fs_free_dic(struct decompress_io_ctx *= dic, } =20 page_array_free(dic->inode, dic->rpages, dic->nr_rpages); + if (late_free) { + spin_lock(&dic->inode->i_lock); + atomic_dec(&dic->inode->i_count); + spin_unlock(&dic->inode->i_lock); + } kmem_cache_free(dic_entry_slab, dic); } =20 @@ -1783,16 +1788,20 @@ static void f2fs_late_free_dic(struct work_struct *= work) struct decompress_io_ctx *dic =3D container_of(work, struct decompress_io_ctx, free_work); =20 - f2fs_free_dic(dic, false); + f2fs_free_dic(dic, false, true); } =20 static void f2fs_put_dic(struct decompress_io_ctx *dic, bool in_task) { if (refcount_dec_and_test(&dic->refcnt)) { if (in_task) { - f2fs_free_dic(dic, false); + f2fs_free_dic(dic, false, false); } else { INIT_WORK(&dic->free_work, f2fs_late_free_dic); + /* to avoid inode is evicted simultaneously */ + spin_lock(&dic->inode->i_lock); + atomic_inc(&dic->inode->i_count); + spin_unlock(&dic->inode->i_lock); queue_work(F2FS_I_SB(dic->inode)->post_read_wq, &dic->free_work); } --=20 1.9.1