[f2fs-dev] [PATCH v3] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

2025-06-05 Thread Zhiguo Niu via Linux-f2fs-devel
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is use

[f2fs-dev] [PATCH] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

2025-06-03 Thread Zhiguo Niu via Linux-f2fs-devel
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is use

[f2fs-dev] [PATCH v2] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

2025-06-04 Thread Zhiguo Niu via Linux-f2fs-devel
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is use

[f2fs-dev] [PATCH 1/2] f2fs: compress: change the first parameter of page_array_{alloc, free} to sbi

2025-06-12 Thread Zhiguo Niu via Linux-f2fs-devel
No logic changes, just cleanup and prepare for fixing the UAF issue in f2fs_free_dic. Signed-off-by: Zhiguo Niu Signed-off-by: Baocong Liu --- fs/f2fs/compress.c | 40 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/fs/f2fs/compress.c b/f

[f2fs-dev] [PATCH 2/2] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

2025-06-12 Thread Zhiguo Niu via Linux-f2fs-devel
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is use

[f2fs-dev] [PATCH] mkfs.f2fs: adjust zone alignment check to correct position

2025-07-14 Thread Zhiguo Niu via Linux-f2fs-devel
Should check these after c.devices[1].start_blkaddr is assigned when c.ndevs > 1. Fixes: 316e128fe3dc ("mkfs.f2fs: adjust zone alignment when using multi-partitions") Signed-off-by: Zhiguo Niu --- mkfs/f2fs_format.c | 23 --- 1 file changed, 12 insertions(+), 11 deletions(-)