[f2fs-dev] [PATCH 4.19] f2fs: fix to do sanity check on inode type during garbage collection

[f2fs-dev] [PATCH 4.19] f2fs: fix to do sanity check on inode type during garbage collection

[Kazunori Kobayashi]

From: Chao Yu <chao@kernel.org>

commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.

As report by Wenqing Liu in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215231

- Overview
kernel NULL pointer dereference triggered  in folio_mark_dirty() when mount and operate on a crafted f2fs image

- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root

1. mkdir mnt
2. mount -t f2fs tmp1.img mnt
3. touch tmp
4. cp tmp mnt

F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
BUG: kernel NULL pointer dereference, address: 0000000000000000
 folio_mark_dirty+0x33/0x50
 move_data_page+0x2dd/0x460 [f2fs]
 do_garbage_collect+0xc18/0x16a0 [f2fs]
 f2fs_gc+0x1d3/0xd90 [f2fs]
 f2fs_balance_fs+0x13a/0x570 [f2fs]
 f2fs_create+0x285/0x840 [f2fs]
 path_openat+0xe6d/0x1040
 do_filp_open+0xc5/0x140
 do_sys_openat2+0x23a/0x310
 do_sys_open+0x57/0x80

The root cause is for special file: e.g. character, block, fifo or socket file,
f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
so, in a fuzzed image, SSA table indicates a data block belong to special file, when
f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
calls a_ops->set_dirty_page().

Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
---
 fs/f2fs/gc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index ff447bbb5248..fb4494c54484 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -958,7 +958,8 @@ static void gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
 
 		if (phase == 3) {
 			inode = f2fs_iget(sb, dni.ino);
-			if (IS_ERR(inode) || is_bad_inode(inode))
+			if (IS_ERR(inode) || is_bad_inode(inode) ||
+					special_file(inode->i_mode))
 				continue;
 
 			if (!down_write_trylock(
-- 
2.39.2



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH 4.19] f2fs: fix to do sanity check on inode type during garbage collection

[Greg KH]

On Wed, Oct 25, 2023 at 08:54:32AM +0000, Kazunori Kobayashi wrote:
> From: Chao Yu <chao@kernel.org>
> 
> commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.
> 
> As report by Wenqing Liu in bugzilla:
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=215231
> 
> - Overview
> kernel NULL pointer dereference triggered  in folio_mark_dirty() when mount and operate on a crafted f2fs image
> 
> - Reproduce
> tested on kernel 5.16-rc3, 5.15.X under root
> 
> 1. mkdir mnt
> 2. mount -t f2fs tmp1.img mnt
> 3. touch tmp
> 4. cp tmp mnt
> 
> F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
> F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
> BUG: kernel NULL pointer dereference, address: 0000000000000000
>  folio_mark_dirty+0x33/0x50
>  move_data_page+0x2dd/0x460 [f2fs]
>  do_garbage_collect+0xc18/0x16a0 [f2fs]
>  f2fs_gc+0x1d3/0xd90 [f2fs]
>  f2fs_balance_fs+0x13a/0x570 [f2fs]
>  f2fs_create+0x285/0x840 [f2fs]
>  path_openat+0xe6d/0x1040
>  do_filp_open+0xc5/0x140
>  do_sys_openat2+0x23a/0x310
>  do_sys_open+0x57/0x80
> 
> The root cause is for special file: e.g. character, block, fifo or socket file,
> f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
> so, in a fuzzed image, SSA table indicates a data block belong to special file, when
> f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
> calls a_ops->set_dirty_page().
> 
> Cc: stable@vger.kernel.org
> Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
> Signed-off-by: Chao Yu <chao@kernel.org>
> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
> Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
> ---
>  fs/f2fs/gc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c

Also applied to 5.4.y and 4.14.y, you can't forget those :)

thanks,

greg k-h


_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel