From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <yuchao0@huawei.com>, Jaegeuk Kim <jaegeuk@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 4.14 28/99] f2fs: fix to clear dirty inode in error path of f2fs_iget()
Date: Sat, 1 Jun 2019 09:22:35 -0400 [thread overview]
Message-ID: <20190601132346.26558-28-sashal@kernel.org> (raw)
In-Reply-To: <20190601132346.26558-1-sashal@kernel.org>
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 546d22f070d64a7b96f57c93333772085d3a5e6d ]
As Jungyeon reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=203217
- Overview
When mounting the attached crafted image and running program, I got this error.
Additionally, it hangs on sync after running the program.
The image is intentionally fuzzed from a normal f2fs image for testing and I enabled option CONFIG_F2FS_CHECK_FS on.
- Reproduces
cc poc_test_05.c
mkdir test
mount -t f2fs tmp.img test
sudo ./a.out
sync
- Messages
kernel BUG at fs/f2fs/inode.c:707!
RIP: 0010:f2fs_evict_inode+0x33f/0x3a0
Call Trace:
evict+0xba/0x180
f2fs_iget+0x598/0xdf0
f2fs_lookup+0x136/0x320
__lookup_slow+0x92/0x140
lookup_slow+0x30/0x50
walk_component+0x1c1/0x350
path_lookupat+0x62/0x200
filename_lookup+0xb3/0x1a0
do_readlinkat+0x56/0x110
__x64_sys_readlink+0x16/0x20
do_syscall_64+0x43/0xf0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
During inode loading, __recover_inline_status() can recovery inode status
and set inode dirty, once we failed in following process, it will fail
the check in f2fs_evict_inode, result in trigger BUG_ON().
Let's clear dirty inode in error path of f2fs_iget() to avoid panic.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 50818b519df8b..e02ed16bc35cd 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -397,6 +397,7 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned long ino)
return inode;
bad_inode:
+ f2fs_inode_synced(inode);
iget_failed(inode);
trace_f2fs_iget_exit(inode, ret);
return ERR_PTR(ret);
--
2.20.1
next prev parent reply other threads:[~2019-06-01 13:32 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-01 13:22 [PATCH AUTOSEL 4.14 01/99] rapidio: fix a NULL pointer dereference when create_workqueue() fails Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 02/99] fs/fat/file.c: issue flush after the writeback of FAT Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 03/99] sysctl: return -EINVAL if val violates minmax Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 04/99] ipc: prevent lockup on alloc_msg and free_msg Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 05/99] ARM: prevent tracing IPI_CPU_BACKTRACE Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 06/99] mm/hmm: select mmu notifier when selecting HMM Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 07/99] hugetlbfs: on restore reserve error path retain subpool reservation Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 08/99] mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 09/99] mm/cma.c: fix crash on CMA allocation if bitmap allocation fails Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 10/99] mm/cma.c: fix the bitmap status to show failed allocation reason Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 11/99] mm/cma_debug.c: fix the break condition in cma_maxchunk_get() Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 12/99] mm/slab.c: fix an infinite loop in leaks_show() Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 13/99] kernel/sys.c: prctl: fix false positive in validate_prctl_map() Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 14/99] thermal: rcar_gen3_thermal: disable interrupt in .remove Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 15/99] drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 16/99] mfd: tps65912-spi: Add missing of table registration Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 17/99] mfd: intel-lpss: Set the device in reset state when init Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 18/99] drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 19/99] mfd: twl6040: Fix device init errors for ACCCTL register Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 20/99] perf/x86/intel: Allow PEBS multi-entry in watermark mode Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 21/99] drm/bridge: adv7511: Fix low refresh rate selection Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 22/99] objtool: Don't use ignore flag for fake jumps Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 23/99] EDAC/mpc85xx: Prevent building as a module Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 24/99] NFS4: Fix v4.0 client state corruption when mount Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 25/99] pwm: meson: Use the spin-lock only to protect register modifications Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 26/99] ntp: Allow TAI-UTC offset to be set to zero Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 27/99] f2fs: fix to avoid panic in do_recover_data() Sasha Levin
2019-06-01 13:22 ` Sasha Levin [this message]
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 29/99] f2fs: fix to avoid panic in dec_valid_block_count() Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 30/99] f2fs: fix to do sanity check on valid block count of segment Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 31/99] percpu: remove spurious lock dependency between percpu and sched Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 32/99] tracing: Fix partial reading of trace event's id file Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 33/99] configfs: fix possible use-after-free in configfs_register_group Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 34/99] uml: fix a boot splat wrt use of cpu_all_mask Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 35/99] mmc: mmci: Prevent polling for busy detection in IRQ context Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 36/99] mips: Make sure dt memory regions are valid Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 37/99] watchdog: Use depends instead of select for pretimeout governors Sasha Levin
2019-06-01 13:22 ` [PATCH AUTOSEL 4.14 38/99] watchdog: imx2_wdt: Fix set_timeout for big timeout values Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190601132346.26558-28-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).