From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+d154ec99402c6f628887@syzkaller.appspotmail.com,
Jaegeuk Kim <jaegeuk@kernel.org>
Subject: [PATCH 4.14 54/54] f2fs: give message and set need_fsck given broken node id
Date: Mon, 16 Jul 2018 09:35:51 +0200 [thread overview]
Message-ID: <20180716073500.490203513@linuxfoundation.org> (raw)
In-Reply-To: <20180716073450.534886211@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit a4f843bd004d775cbb360cd375969b8a479568a9 upstream.
syzbot hit the following crash on upstream commit
83beed7b2b26f232d782127792dd0cd4362fdc41 (Fri Apr 20 17:56:32 2018 +0000)
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=d154ec99402c6f628887
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5414336294027264
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5471683234234368
Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5436660795834368
Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d154ec99402c6f628887@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.
F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
------------[ cut here ]------------
kernel BUG at fs/f2fs/node.c:1185!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4549 Comm: syzkaller704305 Not tainted 4.17.0-rc1+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__get_node_page+0xb68/0x16e0 fs/f2fs/node.c:1185
RSP: 0018:ffff8801d960e820 EFLAGS: 00010293
RAX: ffff8801d88205c0 RBX: 0000000000000003 RCX: ffffffff82f6cc06
RDX: 0000000000000000 RSI: ffffffff82f6d5e8 RDI: 0000000000000004
RBP: ffff8801d960ec30 R08: ffff8801d88205c0 R09: ffffed003b5e46c2
R10: 0000000000000003 R11: 0000000000000003 R12: ffff8801a86e00c0
R13: 0000000000000001 R14: ffff8801a86e0530 R15: ffff8801d9745240
FS: 000000000072c880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3d403209b8 CR3: 00000001d8f3f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
get_node_page fs/f2fs/node.c:1237 [inline]
truncate_xattr_node+0x152/0x2e0 fs/f2fs/node.c:1014
remove_inode_page+0x200/0xaf0 fs/f2fs/node.c:1039
f2fs_evict_inode+0xe86/0x1710 fs/f2fs/inode.c:547
evict+0x4a6/0x960 fs/inode.c:557
iput_final fs/inode.c:1519 [inline]
iput+0x62d/0xa80 fs/inode.c:1545
f2fs_fill_super+0x5f4e/0x7bf0 fs/f2fs/super.c:2849
mount_bdev+0x30c/0x3e0 fs/super.c:1164
f2fs_mount+0x34/0x40 fs/f2fs/super.c:3020
mount_fs+0xae/0x328 fs/super.c:1267
vfs_kern_mount.part.34+0xd4/0x4d0 fs/namespace.c:1037
vfs_kern_mount fs/namespace.c:1027 [inline]
do_new_mount fs/namespace.c:2518 [inline]
do_mount+0x564/0x3070 fs/namespace.c:2848
ksys_mount+0x12d/0x140 fs/namespace.c:3064
__do_sys_mount fs/namespace.c:3078 [inline]
__se_sys_mount fs/namespace.c:3075 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3075
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x443dea
RSP: 002b:00007ffcc7882368 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000c00 RCX: 0000000000443dea
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffcc7882370
RBP: 0000000000000003 R08: 0000000020016a00 R09: 000000000000000a
R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000004
R13: 0000000000402ce0 R14: 0000000000000000 R15: 0000000000000000
RIP: __get_node_page+0xb68/0x16e0 fs/f2fs/node.c:1185 RSP: ffff8801d960e820
---[ end trace 4edbeb71f002bb76 ]---
Reported-and-tested-by: syzbot+d154ec99402c6f628887@syzkaller.appspotmail.com
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/f2fs.h | 13 +------------
fs/f2fs/inode.c | 13 ++++++-------
fs/f2fs/node.c | 21 +++++++++++++++++++--
3 files changed, 26 insertions(+), 21 deletions(-)
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1471,18 +1471,6 @@ static inline bool __exist_node_summarie
}
/*
- * Check whether the given nid is within node id range.
- */
-static inline int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
-{
- if (unlikely(nid < F2FS_ROOT_INO(sbi)))
- return -EINVAL;
- if (unlikely(nid >= NM_I(sbi)->max_nid))
- return -EINVAL;
- return 0;
-}
-
-/*
* Check whether the inode has blocks or not
*/
static inline int F2FS_HAS_BLOCKS(struct inode *inode)
@@ -2470,6 +2458,7 @@ f2fs_hash_t f2fs_dentry_hash(const struc
struct dnode_of_data;
struct node_info;
+int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid);
bool available_free_memory(struct f2fs_sb_info *sbi, int type);
int need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid);
bool is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid);
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -188,12 +188,8 @@ static int do_read_inode(struct inode *i
projid_t i_projid;
/* Check if ino is within scope */
- if (check_nid_range(sbi, inode->i_ino)) {
- f2fs_msg(inode->i_sb, KERN_ERR, "bad inode number: %lu",
- (unsigned long) inode->i_ino);
- WARN_ON(1);
+ if (check_nid_range(sbi, inode->i_ino))
return -EINVAL;
- }
node_page = get_node_page(sbi, inode->i_ino);
if (IS_ERR(node_page))
@@ -538,8 +534,11 @@ no_delete:
alloc_nid_failed(sbi, inode->i_ino);
clear_inode_flag(inode, FI_FREE_NID);
} else {
- f2fs_bug_on(sbi, err &&
- !exist_written_data(sbi, inode->i_ino, ORPHAN_INO));
+ /*
+ * If xattr nid is corrupted, we can reach out error condition,
+ * err & !exist_written_data(sbi, inode->i_ino, ORPHAN_INO)).
+ * In that case, check_nid_range() is enough to give a clue.
+ */
}
out_clear:
fscrypt_put_encryption_info(inode, NULL);
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -29,6 +29,21 @@ static struct kmem_cache *nat_entry_slab
static struct kmem_cache *free_nid_slab;
static struct kmem_cache *nat_entry_set_slab;
+/*
+ * Check whether the given nid is within node id range.
+ */
+int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
+{
+ if (unlikely(nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid)) {
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "%s: out-of-range nid=%x, run fsck to fix.",
+ __func__, nid);
+ return -EINVAL;
+ }
+ return 0;
+}
+
bool available_free_memory(struct f2fs_sb_info *sbi, int type)
{
struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1122,7 +1137,8 @@ void ra_node_page(struct f2fs_sb_info *s
if (!nid)
return;
- f2fs_bug_on(sbi, check_nid_range(sbi, nid));
+ if (check_nid_range(sbi, nid))
+ return;
rcu_read_lock();
apage = radix_tree_lookup(&NODE_MAPPING(sbi)->page_tree, nid);
@@ -1146,7 +1162,8 @@ static struct page *__get_node_page(stru
if (!nid)
return ERR_PTR(-ENOENT);
- f2fs_bug_on(sbi, check_nid_range(sbi, nid));
+ if (check_nid_range(sbi, nid))
+ return ERR_PTR(-EINVAL);
repeat:
page = f2fs_grab_cache_page(NODE_MAPPING(sbi), nid, false);
if (!page)
next prev parent reply other threads:[~2018-07-16 7:42 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-16 7:34 [PATCH 4.14 00/54] 4.14.56-stable review Greg Kroah-Hartman
2018-07-16 7:34 ` [PATCH 4.14 01/54] media: rc: mce_kbd decoder: fix stuck keys Greg Kroah-Hartman
2018-07-16 7:34 ` [PATCH 4.14 02/54] ASoC: mediatek: preallocate pages use platform device Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 03/54] MIPS: Call dump_stack() from show_regs() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 04/54] MIPS: Use async IPIs for arch_trigger_cpumask_backtrace() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 05/54] MIPS: Fix ioremap() RAM check Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 06/54] mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 07/54] mmc: dw_mmc: fix card threshold control configuration Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 08/54] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 09/54] staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 10/54] staging: r8822be: Fix RTL8822be cant find any wireless AP Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 11/54] ata: Fix ZBC_OUT command block check Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 12/54] ata: Fix ZBC_OUT all bit handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 13/54] vmw_balloon: fix inflation with batching Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 14/54] ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 15/54] USB: serial: ch341: fix type promotion bug in ch341_control_in() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 16/54] USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 17/54] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 18/54] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 19/54] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 20/54] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 21/54] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 22/54] devpts: hoist out check for DEVPTS_SUPER_MAGIC Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 23/54] devpts: resolve devpts bind-mounts Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 24/54] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 25/54] genirq/affinity: assign vectors to all possible CPUs Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 26/54] scsi: megaraid_sas: use adapter_type for all gen controllers Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 27/54] scsi: megaraid_sas: replace instance->ctrl_context checks with instance->adapter_type Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 28/54] scsi: megaraid_sas: replace is_ventura with adapter_type checks Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 29/54] scsi: megaraid_sas: Create separate functions to allocate ctrl memory Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 30/54] scsi: megaraid_sas: fix selection of reply queue Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 31/54] ALSA: hda/realtek - two more lenovo models need fixup of MIC_LOCATION Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 32/54] ALSA: hda - Handle pm failure during hotplug Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 33/54] mm: do not drop unused pages when userfaultd is running Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 34/54] fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 35/54] fs, elf: make sure to page align bss in load_elf_library Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 36/54] mm: do not bug_on on incorrect length in __mm_populate() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 37/54] tracing: Reorder display of TGID to be after PID Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 38/54] kbuild: delete INSTALL_FW_PATH from kbuild documentation Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 39/54] arm64: neon: Fix function may_use_simd() return error status Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 40/54] tools build: fix # escaping in .cmd files for future Make Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 41/54] IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 42/54] i2c: tegra: Fix NACK error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 43/54] iw_cxgb4: correctly enforce the max reg_mr depth Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 44/54] xen: setup pv irq ops vector earlier Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 45/54] nvme-pci: Remap CMB SQ entries on every controller reset Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 46/54] crypto: x86/salsa20 - remove x86 salsa20 implementations Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 47/54] uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 48/54] netfilter: nf_queue: augment nfqa_cfg_policy Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 49/54] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 50/54] loop: add recursion validation to LOOP_CHANGE_FD Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 51/54] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 52/54] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 53/54] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
2018-07-16 7:35 ` Greg Kroah-Hartman [this message]
2018-07-16 16:26 ` [PATCH 4.14 00/54] 4.14.56-stable review Guenter Roeck
2018-07-17 8:04 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180716073500.490203513@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jaegeuk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+d154ec99402c6f628887@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.