@@ -1618,7 +1618,6 @@ static void f2fs_put_super(struct super_block *sb)
f2fs_release_ino_entry(sbi, true);
f2fs_leave_shrinker(sbi);
- mutex_unlock(&sbi->umount_mutex);
/* our cp_error case, we can wait for any writeback page */
f2fs_flush_merged_writes(sbi);
@@ -1648,6 +1647,8 @@ static void f2fs_put_super(struct super_block *sb)
iput(sbi->meta_inode);
sbi->meta_inode = NULL;
+ mutex_unlock(&sbi->umount_mutex);
+
/*
* iput() can update stat information, if f2fs_write_checkpoint()
* above failed with error.
When thread A calls kill_f2fs_super, thread A may submit a bio to the function iput(sbi->node_inode); Then thread A enters the process D state, and thread B may also call kill_f2fs_super and execute the code sbi->node_inode = NULL; Now that the bio submitted by thread A is complete, it calls f2fs_write_end_io and may trigger null-ptr-deref in NODE_MAPPING. Thread A Thread B IRQ context - f2fs_put_super - iput(sbi->node_inode) - iput_final - write_inode_now - writeback_single_inode - __writeback_single_inode - filemap_fdatawait - filemap_fdatawait_range - __kcfi_typeid_free_transhuge_page - __filemap_fdatawait_range - wait_on_page_writeback - folio_wait_writeback - folio_wait_bit - folio_wait_bit_common - io_schedule - f2fs_put_super - sbi->node_inode = NULL - __handle_irq_event_percpu - ufs_qcom_mcq_esi_handler - ufshcd_mcq_poll_cqe_nolock - ufshcd_compl_one_cqe - scsi_done - scsi_done_internal - blk_mq_complete_request - scsi_complete - scsi_finish_command - scsi_io_completion - scsi_end_request - blk_update_request - bio_endio - f2fs_write_end_io - NODE_MAPPING(sbi) Signed-off-by: sunshijie <sunshijie@xiaomi.com> --- fs/f2fs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)