From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net,
Roman Smirnov <r.smirnov@omp.ru>
Subject: [f2fs-dev] [PATCH AUTOSEL 6.9 02/28] f2fs: fix to detect inconsistent nat entry during truncation
Date: Wed, 5 Jun 2024 07:48:31 -0400 [thread overview]
Message-ID: <20240605114927.2961639-2-sashal@kernel.org> (raw)
In-Reply-To: <20240605114927.2961639-1-sashal@kernel.org>
From: Chao Yu <chao@kernel.org>
[ Upstream commit 92c556ed6318e13c16746495a8d4513129eb9b0f ]
As Roman Smirnov reported as below:
"
There is a possible bug in f2fs_truncate_inode_blocks():
if (err < 0 && err != -ENOENT)
goto fail;
...
offset[1] = 0;
offset[0]++;
nofs += err;
If err = -ENOENT then nofs will sum with an error code,
which is strange behaviour. Also if nofs < ENOENT this will
cause an overflow. err will be equal to -ENOENT with the
following call stack:
truncate_nodes()
f2fs_get_node_page()
__get_node_page()
read_node_page()
"
If nat is corrupted, truncate_nodes() may return -ENOENT, and
f2fs_truncate_inode_blocks() doesn't handle such error correctly,
fix it.
Reported-by: Roman Smirnov <r.smirnov@omp.ru>
Closes: https://lore.kernel.org/linux-f2fs-devel/085b27fd2b364a3c8c3a9ca77363e246@omp.ru
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/node.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index b3de6d6cdb021..bb57bbaff7b4f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1187,7 +1187,17 @@ int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from)
default:
BUG();
}
- if (err < 0 && err != -ENOENT)
+ if (err == -ENOENT) {
+ set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK);
+ f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
+ f2fs_err_ratelimited(sbi,
+ "truncate node fail, ino:%lu, nid:%u, "
+ "offset[0]:%d, offset[1]:%d, nofs:%d",
+ inode->i_ino, dn.nid, offset[0],
+ offset[1], nofs);
+ err = 0;
+ }
+ if (err < 0)
goto fail;
if (offset[1] == 0 &&
ri->i_nid[offset[0] - NODE_DIR1_BLOCK]) {
--
2.43.0
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <chao@kernel.org>, Roman Smirnov <r.smirnov@omp.ru>,
Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 6.9 02/28] f2fs: fix to detect inconsistent nat entry during truncation
Date: Wed, 5 Jun 2024 07:48:31 -0400 [thread overview]
Message-ID: <20240605114927.2961639-2-sashal@kernel.org> (raw)
In-Reply-To: <20240605114927.2961639-1-sashal@kernel.org>
From: Chao Yu <chao@kernel.org>
[ Upstream commit 92c556ed6318e13c16746495a8d4513129eb9b0f ]
As Roman Smirnov reported as below:
"
There is a possible bug in f2fs_truncate_inode_blocks():
if (err < 0 && err != -ENOENT)
goto fail;
...
offset[1] = 0;
offset[0]++;
nofs += err;
If err = -ENOENT then nofs will sum with an error code,
which is strange behaviour. Also if nofs < ENOENT this will
cause an overflow. err will be equal to -ENOENT with the
following call stack:
truncate_nodes()
f2fs_get_node_page()
__get_node_page()
read_node_page()
"
If nat is corrupted, truncate_nodes() may return -ENOENT, and
f2fs_truncate_inode_blocks() doesn't handle such error correctly,
fix it.
Reported-by: Roman Smirnov <r.smirnov@omp.ru>
Closes: https://lore.kernel.org/linux-f2fs-devel/085b27fd2b364a3c8c3a9ca77363e246@omp.ru
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/node.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index b3de6d6cdb021..bb57bbaff7b4f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1187,7 +1187,17 @@ int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from)
default:
BUG();
}
- if (err < 0 && err != -ENOENT)
+ if (err == -ENOENT) {
+ set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK);
+ f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
+ f2fs_err_ratelimited(sbi,
+ "truncate node fail, ino:%lu, nid:%u, "
+ "offset[0]:%d, offset[1]:%d, nofs:%d",
+ inode->i_ino, dn.nid, offset[0],
+ offset[1], nofs);
+ err = 0;
+ }
+ if (err < 0)
goto fail;
if (offset[1] == 0 &&
ri->i_nid[offset[0] - NODE_DIR1_BLOCK]) {
--
2.43.0
next prev parent reply other threads:[~2024-06-05 11:49 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-05 11:48 [PATCH AUTOSEL 6.9 01/28] usb: gadget: uvc: configfs: ensure guid to be valid before set Sasha Levin
2024-06-05 11:48 ` Sasha Levin [this message]
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 02/28] f2fs: fix to detect inconsistent nat entry during truncation Sasha Levin
2024-06-05 11:48 ` [f2fs-dev] [PATCH AUTOSEL 6.9 03/28] f2fs: remove clear SB_INLINECRYPT flag in default_options Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 04/28] usb: typec: ucsi_glink: rework quirks implementation Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 05/28] usb: misc: uss720: check for incompatible versions of the Belkin F5U002 Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 06/28] Avoid hw_desc array overrun in dw-axi-dmac Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 07/28] usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380 Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 08/28] usb: typec: ucsi_glink: drop special handling for CCI_BUSY Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 09/28] udf: udftime: prevent overflow in udf_disk_stamp_to_time() Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 10/28] PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports Sasha Levin
2024-06-05 11:48 ` [f2fs-dev] [PATCH AUTOSEL 6.9 11/28] f2fs: don't set RO when shutting down f2fs Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 12/28] MIPS: Octeon: Add PCIe link status check Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 13/28] serial: imx: Introduce timeout when waiting on transmitter empty Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 14/28] serial: exar: adding missing CTI and Exar PCI ids Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 15/28] usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 16/28] usb: dwc3: core: Access XHCI address space temporarily to read port info Sasha Levin
2024-06-05 11:53 ` Johan Hovold
2024-06-19 14:33 ` Sasha Levin
2024-06-05 11:48 ` [f2fs-dev] [PATCH AUTOSEL 6.9 17/28] f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 18/28] xhci: remove XHCI_TRUST_TX_LENGTH quirk Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 19/28] tty: add the option to have a tty reject a new ldisc Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 20/28] greybus: Fix use-after-free bug in gb_interface_release due to race condition Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 21/28] i2c: lpi2c: Avoid calling clk_get_rate during transfer Sasha Levin
2024-06-05 11:48 ` Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 22/28] cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 23/28] vfio/pci: Collect hot-reset devices to local buffer Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 24/28] usb: typec: qcom-pmic-typec: split HPD bridge alloc and registration Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 25/28] cpufreq: amd-pstate: fix memory leak on CPU EPP exit Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 26/28] ACPI: EC: Install address space handler at the namespace root Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 27/28] PCI: Do not wait for disconnected devices when resuming Sasha Levin
2024-06-05 11:48 ` [PATCH AUTOSEL 6.9 28/28] OPP: Fix required_opp_tables for multiple genpds using same table Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240605114927.2961639-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=r.smirnov@omp.ru \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.