From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net,
Dipanjan Das <mail.dipanjan.das@gmail.com>,
Jaegeuk Kim <jaegeuk@kernel.org>
Subject: [f2fs-dev] [PATCH AUTOSEL 5.18 33/39] f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
Date: Sun, 14 Aug 2022 12:23:22 -0400 [thread overview]
Message-ID: <20220814162332.2396012-33-sashal@kernel.org> (raw)
In-Reply-To: <20220814162332.2396012-1-sashal@kernel.org>
From: Chao Yu <chao.yu@oppo.com>
[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ]
As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller
found a f2fs bug as below:
RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
Call Trace:
write_all_xattrs fs/f2fs/xattr.c:487 [inline]
__f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
__vfs_setxattr+0x115/0x180 fs/xattr.c:182
__vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
__vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
vfs_setxattr+0x13f/0x330 fs/xattr.c:303
setxattr+0x146/0x160 fs/xattr.c:611
path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
__do_sys_lsetxattr fs/xattr.c:653 [inline]
__se_sys_lsetxattr fs/xattr.c:649 [inline]
__x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
may trigger BUG_ON() in f2fs_new_node_page(), fix it.
Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
Signed-off-by: Chao Yu <chao.yu@oppo.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/node.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index aedc3d334113..1cd89ce34418 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1296,7 +1296,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
dec_valid_node_count(sbi, dn->inode, !ofs);
goto fail;
}
- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR);
+ if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
+ err = -EFSCORRUPTED;
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ goto fail;
+ }
#endif
new_ni.nid = dn->nid;
new_ni.ino = dn->inode->i_ino;
--
2.35.1
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <chao.yu@oppo.com>,
Dipanjan Das <mail.dipanjan.das@gmail.com>,
Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>,
chao@kernel.org, linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 5.18 33/39] f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
Date: Sun, 14 Aug 2022 12:23:22 -0400 [thread overview]
Message-ID: <20220814162332.2396012-33-sashal@kernel.org> (raw)
In-Reply-To: <20220814162332.2396012-1-sashal@kernel.org>
From: Chao Yu <chao.yu@oppo.com>
[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ]
As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller
found a f2fs bug as below:
RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
Call Trace:
write_all_xattrs fs/f2fs/xattr.c:487 [inline]
__f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
__vfs_setxattr+0x115/0x180 fs/xattr.c:182
__vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
__vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
vfs_setxattr+0x13f/0x330 fs/xattr.c:303
setxattr+0x146/0x160 fs/xattr.c:611
path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
__do_sys_lsetxattr fs/xattr.c:653 [inline]
__se_sys_lsetxattr fs/xattr.c:649 [inline]
__x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
may trigger BUG_ON() in f2fs_new_node_page(), fix it.
Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
Signed-off-by: Chao Yu <chao.yu@oppo.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/node.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index aedc3d334113..1cd89ce34418 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1296,7 +1296,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
dec_valid_node_count(sbi, dn->inode, !ofs);
goto fail;
}
- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR);
+ if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
+ err = -EFSCORRUPTED;
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ goto fail;
+ }
#endif
new_ni.nid = dn->nid;
new_ni.ino = dn->inode->i_ino;
--
2.35.1
next prev parent reply other threads:[~2022-08-14 16:26 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-14 16:22 [PATCH AUTOSEL 5.18 01/39] lib/list_debug.c: Detect uninitialized lists Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 02/39] tty: serial: Fix refcount leak bug in ucc_uart.c Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 03/39] KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 04/39] vfio: Clear the caps->buf to NULL after free Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 05/39] mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 06/39] iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 07/39] riscv: dts: microchip: Add mpfs' topology information Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 08/39] ALSA: hda: Fix page fault in snd_hda_codec_shutdown() Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 09/39] modules: Ensure natural alignment for .altinstructions and __bug_table sections Sasha Levin
2022-08-14 16:22 ` [PATCH AUTOSEL 5.18 10/39] ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl() Sasha Levin
2022-08-14 16:22 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 11/39] riscv: dts: sifive: Add fu540 topology information Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 12/39] riscv: dts: sifive: Add fu740 " Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 13/39] riscv: dts: canaan: Add k210 " Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 14/39] riscv: mmap with PROT_WRITE but no PROT_READ is invalid Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 15/39] RISC-V: Add fast call path of crash_kexec() Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 16/39] ALSA: hda/realtek: Enable speaker and mute LEDs for HP laptops Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 17/39] ASoC: SOF: Intel: hda: add sanity check on SSP index reported by NHLT Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 18/39] ASoC: Intel: sof_es8336: Fix GPIO quirks set via module option Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 19/39] ASoC: Intel: sof_es8336: ignore GpioInt when looking for speaker/headset GPIO lines Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 20/39] ASoC: Intel: sof_nau8825: Move quirk check to the front in late probe Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 21/39] watchdog: export lockup_detector_reconfigure Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 22/39] powerpc/watchdog: introduce a NMI watchdog's factor Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 23/39] powerpc/pseries/mobility: set NMI watchdog factor during an LPM Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 24/39] powerpc/32: Set an IBAT covering up to _einittext during init Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 25/39] powerpc/32: Don't always pass -mcpu=powerpc to the compiler Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 26/39] ASoC: codecs: va-macro: use fsgen as clock Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 27/39] ovl: warn if trusted xattr creation fails Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 28/39] powerpc/ioda/iommu/debugfs: Generate unique debugfs entries Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 29/39] ALSA: core: Add async signal helpers Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 30/39] ALSA: timer: Use deferred fasync helper Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 31/39] ALSA: pcm: " Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 32/39] ALSA: control: " Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` Sasha Levin [this message]
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 33/39] f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() Sasha Levin
2022-08-14 16:23 ` [f2fs-dev] [PATCH AUTOSEL 5.18 34/39] f2fs: fix to do sanity check on segment type in build_sit_entries() Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 35/39] smb3: check xattr value length earlier Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 36/39] powerpc/64: Init jump labels before parse_early_param() Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 37/39] venus: pm_helpers: Fix warning in OPP during probe Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 38/39] video: fbdev: i740fb: Check the argument of i740_calc_vclk() Sasha Levin
2022-08-14 16:23 ` Sasha Levin
2022-08-14 16:23 ` [PATCH AUTOSEL 5.18 39/39] MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220814162332.2396012-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mail.dipanjan.das@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.