Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2] f2fs: fix use-after-free issue when accessing
 sbi->stat_info
To:     Sahitya Tummala <stummala@codeaurora.org>,
        Jaegeuk Kim <jaegeuk@kernel.org>,
        <linux-f2fs-devel@lists.sourceforge.net>
CC:     <linux-kernel@vger.kernel.org>
References: <1545803429-14340-1-git-send-email-stummala@codeaurora.org>
From:   Chao Yu <yuchao0@huawei.com>
Message-ID: <7f89b0c1-fc5d-8c83-0ecc-0b0943b7be69@huawei.com>
Date:   Wed, 26 Dec 2018 17:55:51 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <1545803429-14340-1-git-send-email-stummala@codeaurora.org>
Content-Type: text/plain; charset="windows-1252"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 2018/12/26 13:50, Sahitya Tummala wrote:
> iput() on sbi->node_inode can update sbi->stat_info
> in the below context, if the f2fs_write_checkpoint()
> has failed with error.
> 
> f2fs_balance_fs_bg+0x1ac/0x1ec
> f2fs_write_node_pages+0x4c/0x260
> do_writepages+0x80/0xbc
> __writeback_single_inode+0xdc/0x4ac
> writeback_single_inode+0x9c/0x144
> write_inode_now+0xc4/0xec
> iput+0x194/0x22c
> f2fs_put_super+0x11c/0x1e8
> generic_shutdown_super+0x70/0xf4
> kill_block_super+0x2c/0x5c
> kill_f2fs_super+0x44/0x50
> deactivate_locked_super+0x60/0x8c
> deactivate_super+0x68/0x74
> cleanup_mnt+0x40/0x78
> 
> Fix this by moving f2fs_destroy_stats() further below iput() in
> both f2fs_put_super() and f2fs_fill_super() paths.
> 
> Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>

It looks good to me now. :)

Reviewed-by: Chao Yu <yuchao0@huawei.com>

Thanks,