Commit 5909bedb authored by Yongpeng Yang's avatar Yongpeng Yang Committed by Jaegeuk Kim
Browse files

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() 



In f2fs_sbi_show(), the extension_list, extension_count and
hot_ext_count are read without holding sbi->sb_lock. If a concurrent
sysfs store modifies the extension list via f2fs_update_extension_list(),
the show path may read inconsistent count and array contents, potentially
leading to out-of-bounds access or displaying stale data.

Fix this by holding sb_lock around the entire extension list read
and format operation.

Fixes: b6a06cbb ("f2fs: support hot file extension")
Signed-off-by: default avatarYongpeng Yang <yangyongpeng@xiaomi.com>
Reviewed-by: default avatarChao Yu <chao@kernel.org>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent b8b902fd

fs/f2fs/sysfs.c

+5 −2
Original line number Diff line number Diff line
@@ -387,10 +387,12 @@ static ssize_t f2fs_sbi_show(struct f2fs_attr *a, 
	if (!strcmp(a->attr.name, "extension_list")) {

		__u8 (*extlist)[F2FS_EXTENSION_LEN] =

					sbi->raw_super->extension_list;

		int cold_count = le32_to_cpu(sbi->raw_super->extension_count);

		int hot_count = sbi->raw_super->hot_ext_count;

		int cold_count, hot_count;

		int len = 0, i;



		f2fs_down_read(&sbi->sb_lock);

		cold_count = le32_to_cpu(sbi->raw_super->extension_count);

		hot_count = sbi->raw_super->hot_ext_count;

		len += sysfs_emit_at(buf, len, "cold file extension:\n");

		for (i = 0; i < cold_count; i++)

			len += sysfs_emit_at(buf, len, "%s\n", extlist[i]);
@@ -398,6 +400,7 @@ static ssize_t f2fs_sbi_show(struct f2fs_attr *a, 
		len += sysfs_emit_at(buf, len, "hot file extension:\n");

		for (i = cold_count; i < cold_count + hot_count; i++)

			len += sysfs_emit_at(buf, len, "%s\n", extlist[i]);

		f2fs_up_read(&sbi->sb_lock);



		return len;

	}