Patch "f2fs: fix to invalidate dcc->f2fs_issue_discard in error path" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    f2fs: fix to invalidate dcc->f2fs_issue_discard in error path

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     f2fs-fix-to-invalidate-dcc-f2fs_issue_discard-in-err.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 25166986c43493381fcbf025c3b393f0914202b3
Author: Chao Yu <chao@xxxxxxxxxx>
Date:   Fri Oct 21 10:34:22 2022 +0800

    f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
    
    [ Upstream commit 91586ce0d39a05f88795aa8814fb99b1387236b3 ]
    
    Syzbot reports a NULL pointer dereference issue as below:
    
     __refcount_add include/linux/refcount.h:193 [inline]
     __refcount_inc include/linux/refcount.h:250 [inline]
     refcount_inc include/linux/refcount.h:267 [inline]
     get_task_struct include/linux/sched/task.h:110 [inline]
     kthread_stop+0x34/0x1c0 kernel/kthread.c:703
     f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638
     kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522
     deactivate_locked_super+0x70/0xe8 fs/super.c:332
     deactivate_super+0xd0/0xd4 fs/super.c:363
     cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186
     __cleanup_mnt+0x20/0x30 fs/namespace.c:1193
     task_work_run+0xc4/0x14c kernel/task_work.c:177
     exit_task_work include/linux/task_work.h:38 [inline]
     do_exit+0x26c/0xbe0 kernel/exit.c:795
     do_group_exit+0x60/0xe8 kernel/exit.c:925
     __do_sys_exit_group kernel/exit.c:936 [inline]
     __se_sys_exit_group kernel/exit.c:934 [inline]
     __wake_up_parent+0x0/0x40 kernel/exit.c:934
     __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
     invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
     el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
     do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
     el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
     el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
     el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
    
    The root cause of this issue is in error path of f2fs_start_discard_thread(),
    it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may
    access invalid pointer.
    
    Fixes: 4d67490498ac ("f2fs: Don't create discard thread when device doesn't support realtime discard")
    Reported-by: syzbot+035a381ea1afb63f098d@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reported-by: syzbot+729c925c2d9fc495ddee@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Chao Yu <chao@xxxxxxxxxx>
    Signed-off-by: Jaegeuk Kim <jaegeuk@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 84bad18ce13d..10d8bc81cff7 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -2026,8 +2026,10 @@ int f2fs_start_discard_thread(struct f2fs_sb_info *sbi)
 
 	dcc->f2fs_issue_discard = kthread_run(issue_discard_thread, sbi,
 				"f2fs_discard-%u:%u", MAJOR(dev), MINOR(dev));
-	if (IS_ERR(dcc->f2fs_issue_discard))
+	if (IS_ERR(dcc->f2fs_issue_discard)) {
 		err = PTR_ERR(dcc->f2fs_issue_discard);
+		dcc->f2fs_issue_discard = NULL;
+	}
 
 	return err;
 }