[PATCH] f2fs: compress: fix to avoid NULL pointer dereference

From: Chao Yu
Date: Fri Jan 17 2020 - 02:59:17 EST


If cluster has only one compressed page, race condition as below will
trigger NULL pointer dereference:

- f2fs_write_compressed_pages
- cic->rpages[0] = cc->rpages[0];
- f2fs_outplace_write_data
- f2fs_compress_write_end_io
- WARN_ON(!cic->rpages[1]);
- cic->rpages[1] = cc->rpages[1];

Signed-off-by: Chao Yu <yuchao0@xxxxxxxxxx>
---
fs/f2fs/compress.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 45a6f20ceb3e..d8a64be90a50 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -837,12 +837,15 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,

set_cluster_writeback(cc);

+ for (i = 0; i < cc->cluster_size; i++)
+ cic->rpages[i] = cc->rpages[i];
+
for (i = 0; i < cc->cluster_size; i++, dn.ofs_in_node++) {
block_t blkaddr;

blkaddr = datablock_addr(dn.inode, dn.node_page,
dn.ofs_in_node);
- fio.page = cic->rpages[i] = cc->rpages[i];
+ fio.page = cic->rpages[i];
fio.old_blkaddr = blkaddr;

/* cluster header */
--
2.18.0.rc1