From: Chao Yu via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>
To: jaegeuk@kernel.org
Cc: stable@kernel.org, linux-kernel@vger.kernel.org,
linux-f2fs-devel@lists.sourceforge.net
Subject: [f2fs-dev] [PATCH 1/2] f2fs: fix to do sanity check on node folio during its writeback
Date: Sat, 11 Oct 2025 20:30:15 +0800 [thread overview]
Message-ID: <20251011123016.715964-1-chao@kernel.org> (raw)
Add more sanity check on node folio during its writeback, if node footer
indicates it is an inode:
- i_mode should be consistent w/ inode
- ofs_of_node should be consistent w/ non-xattr node
In addition, if sanity check fails, let's shutdown filesystem to avoid
looping to redirty and writeback it.
Cc: stable@kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
---
fs/f2fs/node.c | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 482a362f2625..2bb9e6d35080 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1504,20 +1504,37 @@ static int sanity_check_node_footer(struct f2fs_sb_info *sbi,
struct folio *folio, pgoff_t nid,
enum node_type ntype)
{
+ bool is_inode;
+
if (unlikely(nid != nid_of_node(folio)))
goto out_err;
+ is_inode = IS_INODE(folio);
+
switch (ntype) {
+ case NODE_TYPE_REGULAR:
+ if (is_inode) {
+ umode_t m = le16_to_cpu(F2FS_INODE(folio)->i_mode);
+
+ if (!S_ISLNK(m) && !S_ISREG(m) && !S_ISDIR(m) &&
+ !S_ISCHR(m) && !S_ISBLK(m) && !S_ISFIFO(m) &&
+ !S_ISSOCK(m))
+ goto out_err;
+
+ if (f2fs_has_xattr_block(ofs_of_node(folio)))
+ goto out_err;
+ }
+ break;
case NODE_TYPE_INODE:
- if (!IS_INODE(folio))
+ if (!is_inode)
goto out_err;
break;
case NODE_TYPE_XATTR:
- if (!f2fs_has_xattr_block(ofs_of_node(folio)))
+ if (is_inode || !f2fs_has_xattr_block(ofs_of_node(folio)))
goto out_err;
break;
case NODE_TYPE_NON_INODE:
- if (IS_INODE(folio))
+ if (is_inode)
goto out_err;
break;
default:
@@ -1751,7 +1768,11 @@ static bool __write_node_folio(struct folio *folio, bool atomic, bool *submitted
/* get old block addr of this node page */
nid = nid_of_node(folio);
- f2fs_bug_on(sbi, folio->index != nid);
+
+ if (sanity_check_node_footer(sbi, folio, nid, NODE_TYPE_REGULAR)) {
+ f2fs_handle_critical_error(sbi, STOP_CP_REASON_CORRUPTED_NID);
+ goto redirty_out;
+ }
if (f2fs_get_node_info(sbi, nid, &ni, !do_balance))
goto redirty_out;
--
2.49.0
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Chao Yu <chao@kernel.org>
To: jaegeuk@kernel.org
Cc: linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, Chao Yu <chao@kernel.org>,
stable@kernel.org
Subject: [PATCH 1/2] f2fs: fix to do sanity check on node folio during its writeback
Date: Sat, 11 Oct 2025 20:30:15 +0800 [thread overview]
Message-ID: <20251011123016.715964-1-chao@kernel.org> (raw)
Add more sanity check on node folio during its writeback, if node footer
indicates it is an inode:
- i_mode should be consistent w/ inode
- ofs_of_node should be consistent w/ non-xattr node
In addition, if sanity check fails, let's shutdown filesystem to avoid
looping to redirty and writeback it.
Cc: stable@kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
---
fs/f2fs/node.c | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 482a362f2625..2bb9e6d35080 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1504,20 +1504,37 @@ static int sanity_check_node_footer(struct f2fs_sb_info *sbi,
struct folio *folio, pgoff_t nid,
enum node_type ntype)
{
+ bool is_inode;
+
if (unlikely(nid != nid_of_node(folio)))
goto out_err;
+ is_inode = IS_INODE(folio);
+
switch (ntype) {
+ case NODE_TYPE_REGULAR:
+ if (is_inode) {
+ umode_t m = le16_to_cpu(F2FS_INODE(folio)->i_mode);
+
+ if (!S_ISLNK(m) && !S_ISREG(m) && !S_ISDIR(m) &&
+ !S_ISCHR(m) && !S_ISBLK(m) && !S_ISFIFO(m) &&
+ !S_ISSOCK(m))
+ goto out_err;
+
+ if (f2fs_has_xattr_block(ofs_of_node(folio)))
+ goto out_err;
+ }
+ break;
case NODE_TYPE_INODE:
- if (!IS_INODE(folio))
+ if (!is_inode)
goto out_err;
break;
case NODE_TYPE_XATTR:
- if (!f2fs_has_xattr_block(ofs_of_node(folio)))
+ if (is_inode || !f2fs_has_xattr_block(ofs_of_node(folio)))
goto out_err;
break;
case NODE_TYPE_NON_INODE:
- if (IS_INODE(folio))
+ if (is_inode)
goto out_err;
break;
default:
@@ -1751,7 +1768,11 @@ static bool __write_node_folio(struct folio *folio, bool atomic, bool *submitted
/* get old block addr of this node page */
nid = nid_of_node(folio);
- f2fs_bug_on(sbi, folio->index != nid);
+
+ if (sanity_check_node_footer(sbi, folio, nid, NODE_TYPE_REGULAR)) {
+ f2fs_handle_critical_error(sbi, STOP_CP_REASON_CORRUPTED_NID);
+ goto redirty_out;
+ }
if (f2fs_get_node_info(sbi, nid, &ni, !do_balance))
goto redirty_out;
--
2.49.0
next reply other threads:[~2025-10-11 12:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-11 12:30 Chao Yu via Linux-f2fs-devel [this message]
2025-10-11 12:30 ` [PATCH 1/2] f2fs: fix to do sanity check on node folio during its writeback Chao Yu
2025-10-11 12:30 ` [f2fs-dev] [PATCH 2/2] f2fs: fix to do sanity check on node footer in {read, write}_end_io Chao Yu via Linux-f2fs-devel
2025-10-11 12:30 ` [PATCH 2/2] f2fs: fix to do sanity check on node footer in {read,write}_end_io Chao Yu
2025-11-11 22:50 ` [f2fs-dev] [PATCH 1/2] f2fs: fix to do sanity check on node folio during its writeback patchwork-bot+f2fs--- via Linux-f2fs-devel
2025-11-11 22:50 ` patchwork-bot+f2fs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251011123016.715964-1-chao@kernel.org \
--to=linux-f2fs-devel@lists.sourceforge.net \
--cc=chao@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.