From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net,
Jaegeuk Kim <jaegeuk@kernel.org>
Subject: [f2fs-dev] [PATCH AUTOSEL 5.12 12/37] f2fs: fix to avoid NULL pointer dereference
Date: Wed, 12 May 2021 14:00:39 -0400 [thread overview]
Message-ID: <20210512180104.664121-12-sashal@kernel.org> (raw)
In-Reply-To: <20210512180104.664121-1-sashal@kernel.org>
From: Yi Chen <chenyi77@huawei.com>
[ Upstream commit 594b6d0428ae304e0b44457398beb458b938f005 ]
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
pc : f2fs_put_page+0x1c/0x26c
lr : __revoke_inmem_pages+0x544/0x75c
f2fs_put_page+0x1c/0x26c
__revoke_inmem_pages+0x544/0x75c
__f2fs_commit_inmem_pages+0x364/0x3c0
f2fs_commit_inmem_pages+0xc8/0x1a0
f2fs_ioc_commit_atomic_write+0xa4/0x15c
f2fs_ioctl+0x5b0/0x1574
file_ioctl+0x154/0x320
do_vfs_ioctl+0x164/0x740
__arm64_sys_ioctl+0x78/0xa4
el0_svc_common+0xbc/0x1d0
el0_svc_handler+0x74/0x98
el0_svc+0x8/0xc
In f2fs_put_page, we access page->mapping is NULL.
The root cause is:
In some cases, the page refcount and ATOMIC_WRITTEN_PAGE
flag miss set for page-priavte flag has been set.
We add f2fs_bug_on like this:
f2fs_register_inmem_page()
{
...
f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
f2fs_bug_on(F2FS_I_SB(inode), !IS_ATOMIC_WRITTEN_PAGE(page));
...
}
The bug on stack follow link this:
PC is at f2fs_register_inmem_page+0x238/0x2b4
LR is at f2fs_register_inmem_page+0x2a8/0x2b4
f2fs_register_inmem_page+0x238/0x2b4
f2fs_set_data_page_dirty+0x104/0x164
set_page_dirty+0x78/0xc8
f2fs_write_end+0x1b4/0x444
generic_perform_write+0x144/0x1cc
__generic_file_write_iter+0xc4/0x174
f2fs_file_write_iter+0x2c0/0x350
__vfs_write+0x104/0x134
vfs_write+0xe8/0x19c
SyS_pwrite64+0x78/0xb8
To fix this issue, let's add page refcount add page-priavte flag.
The page-private flag is not cleared and needs further analysis.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Ge Qiu <qiuge@huawei.com>
Signed-off-by: Dehe Gu <gudehe@huawei.com>
Signed-off-by: Yi Chen <chenyi77@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index c2866561263e..9010c3d9715e 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -186,7 +186,10 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page)
{
struct inmem_pages *new;
- f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
+ if (PagePrivate(page))
+ set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE);
+ else
+ f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
new = f2fs_kmem_cache_alloc(inmem_entry_slab, GFP_NOFS);
--
2.30.2
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yi Chen <chenyi77@huawei.com>, Chao Yu <yuchao0@huawei.com>,
Ge Qiu <qiuge@huawei.com>, Dehe Gu <gudehe@huawei.com>,
Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 5.12 12/37] f2fs: fix to avoid NULL pointer dereference
Date: Wed, 12 May 2021 14:00:39 -0400 [thread overview]
Message-ID: <20210512180104.664121-12-sashal@kernel.org> (raw)
In-Reply-To: <20210512180104.664121-1-sashal@kernel.org>
From: Yi Chen <chenyi77@huawei.com>
[ Upstream commit 594b6d0428ae304e0b44457398beb458b938f005 ]
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
pc : f2fs_put_page+0x1c/0x26c
lr : __revoke_inmem_pages+0x544/0x75c
f2fs_put_page+0x1c/0x26c
__revoke_inmem_pages+0x544/0x75c
__f2fs_commit_inmem_pages+0x364/0x3c0
f2fs_commit_inmem_pages+0xc8/0x1a0
f2fs_ioc_commit_atomic_write+0xa4/0x15c
f2fs_ioctl+0x5b0/0x1574
file_ioctl+0x154/0x320
do_vfs_ioctl+0x164/0x740
__arm64_sys_ioctl+0x78/0xa4
el0_svc_common+0xbc/0x1d0
el0_svc_handler+0x74/0x98
el0_svc+0x8/0xc
In f2fs_put_page, we access page->mapping is NULL.
The root cause is:
In some cases, the page refcount and ATOMIC_WRITTEN_PAGE
flag miss set for page-priavte flag has been set.
We add f2fs_bug_on like this:
f2fs_register_inmem_page()
{
...
f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
f2fs_bug_on(F2FS_I_SB(inode), !IS_ATOMIC_WRITTEN_PAGE(page));
...
}
The bug on stack follow link this:
PC is at f2fs_register_inmem_page+0x238/0x2b4
LR is at f2fs_register_inmem_page+0x2a8/0x2b4
f2fs_register_inmem_page+0x238/0x2b4
f2fs_set_data_page_dirty+0x104/0x164
set_page_dirty+0x78/0xc8
f2fs_write_end+0x1b4/0x444
generic_perform_write+0x144/0x1cc
__generic_file_write_iter+0xc4/0x174
f2fs_file_write_iter+0x2c0/0x350
__vfs_write+0x104/0x134
vfs_write+0xe8/0x19c
SyS_pwrite64+0x78/0xb8
To fix this issue, let's add page refcount add page-priavte flag.
The page-private flag is not cleared and needs further analysis.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Ge Qiu <qiuge@huawei.com>
Signed-off-by: Dehe Gu <gudehe@huawei.com>
Signed-off-by: Yi Chen <chenyi77@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index c2866561263e..9010c3d9715e 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -186,7 +186,10 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page)
{
struct inmem_pages *new;
- f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
+ if (PagePrivate(page))
+ set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE);
+ else
+ f2fs_set_page_private(page, ATOMIC_WRITTEN_PAGE);
new = f2fs_kmem_cache_alloc(inmem_entry_slab, GFP_NOFS);
--
2.30.2
next prev parent reply other threads:[~2021-05-12 18:01 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-12 18:00 [PATCH AUTOSEL 5.12 01/37] ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6 Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 02/37] PCI: thunder: Fix compile testing Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 03/37] dmaengine: dw-edma: Fix crash on loading/unloading driver Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 04/37] ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend() Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [f2fs-dev] [PATCH AUTOSEL 5.12 05/37] f2fs: fix to avoid out-of-bounds memory access Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 06/37] NFS: Fix fscache invalidation in nfs_set_cache_invalid() Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 07/37] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 08/37] PCI: tegra: Fix runtime PM imbalance in pex_ep_event_pex_rst_deassert() Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 09/37] Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 10/37] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 11/37] NFS: NFS_INO_REVAL_PAGECACHE should mark the change attribute invalid Sasha Levin
2021-05-12 18:00 ` Sasha Levin [this message]
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 12/37] f2fs: fix to avoid NULL pointer dereference Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 13/37] svcrdma: Don't leak send_ctxt on Send errors Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 14/37] um: Mark all kernel symbols as local Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 15/37] um: Disable CONFIG_GCOV with MODULES Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 16/37] PCI: tegra: Add Tegra194 MCFG quirks for ECAM errata Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 17/37] ARM: 9075/1: kernel: Fix interrupted SMC calls Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 18/37] platform/chrome: cros_ec_typec: Add DP mode check Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 19/37] riscv: Use $(LD) instead of $(CC) to link vDSO Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 20/37] scripts/recordmcount.pl: Fix RISC-V regex for clang Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 21/37] riscv: Workaround mcount name prior to clang-13 Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 22/37] scsi: lpfc: Fix illegal memory access on Abort IOCBs Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 23/37] ceph: fix fscache invalidation Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 24/37] ceph: don't clobber i_snap_caps on non-I_NEW inode Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 25/37] ceph: don't allow access to MDS-private inodes Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 26/37] scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 27/37] amdgpu/pm: Prevent force of DCEFCLK on NAVI10 and SIENNA_CICHLID Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [Bridge] [PATCH AUTOSEL 5.12 28/37] bridge: Fix possible races between assigning rx_handler_data and setting IFF_BRIDGE_PORT bit Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 29/37] net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 30/37] nvmet: remove unsupported command noise Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 31/37] drm/amd/display: Fix two cursor duplication when using overlay Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` Sasha Levin
2021-05-12 18:00 ` [PATCH AUTOSEL 5.12 32/37] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 Sasha Levin
2021-05-12 18:01 ` [PATCH AUTOSEL 5.12 33/37] net:CXGB4: fix leak if sk_buff is not used Sasha Levin
2021-05-12 18:01 ` [PATCH AUTOSEL 5.12 34/37] ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP Sasha Levin
2021-05-12 18:01 ` Sasha Levin
2021-05-12 18:01 ` [PATCH AUTOSEL 5.12 35/37] block: reexpand iov_iter after read/write Sasha Levin
2021-05-12 18:01 ` [PATCH AUTOSEL 5.12 36/37] lib: stackdepot: turn depot_lock spinlock to raw_spinlock Sasha Levin
2021-05-12 18:01 ` [PATCH AUTOSEL 5.12 37/37] net: stmmac: Do not enable RX FIFO overflow interrupts Sasha Levin
2021-05-12 18:01 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210512180104.664121-12-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.