From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <yuchao0@huawei.com>,
syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com,
Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 4.9 04/30] f2fs: fix to check segment boundary during SIT page readahead
Date: Mon, 26 Oct 2020 20:10:18 -0400 [thread overview]
Message-ID: <20201027001044.1027349-4-sashal@kernel.org> (raw)
In-Reply-To: <20201027001044.1027349-1-sashal@kernel.org>
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]
As syzbot reported:
kernel BUG at fs/f2fs/segment.h:657!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657
Call Trace:
build_sit_entries fs/f2fs/segment.c:4195 [inline]
f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779
f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633
mount_bdev+0x32e/0x3f0 fs/super.c:1417
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
do_new_mount fs/namespace.c:2875 [inline]
path_mount+0x1387/0x2070 fs/namespace.c:3192
do_mount fs/namespace.c:3205 [inline]
__do_sys_mount fs/namespace.c:3413 [inline]
__se_sys_mount fs/namespace.c:3390 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
@blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic
in following sanity check in current_sit_addr(), add check condition to
avoid this issue.
Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/checkpoint.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index c1b24d7aa6ef1..5e9f8ec8251d3 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -201,6 +201,8 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
blkno * NAT_ENTRY_PER_BLOCK);
break;
case META_SIT:
+ if (unlikely(blkno >= TOTAL_SEGS(sbi)))
+ goto out;
/* get sit block addr */
fio.new_blkaddr = current_sit_addr(sbi,
blkno * SIT_ENTRY_PER_BLOCK);
--
2.25.1
next prev parent reply other threads:[~2020-10-27 0:17 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-27 0:10 [PATCH AUTOSEL 4.9 01/30] powerpc/powernv/smp: Fix spurious DBG() warning Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 02/30] sparc64: remove mm_cpumask clearing to fix kthread_use_mm race Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 03/30] f2fs: add trace exit in exception path Sasha Levin
2020-10-27 0:10 ` Sasha Levin [this message]
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 05/30] um: change sigio_spinlock to a mutex Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 06/30] ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 07/30] xfs: fix realtime bitmap/summary file truncation when growing rt volume Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 08/30] video: fbdev: pvr2fb: initialize variables Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 09/30] ath10k: fix VHT NSS calculation when STBC is enabled Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 10/30] media: tw5864: check status of tw5864_frameinterval_get Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 11/30] mmc: via-sdmmc: Fix data race bug Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 12/30] printk: reduce LOG_BUF_SHIFT range for H8300 Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 13/30] kgdb: Make "kgdbcon" work properly with "kgdb_earlycon" Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 14/30] cpufreq: sti-cpufreq: add stih418 support Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 15/30] USB: adutux: fix debugging Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 16/30] arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 17/30] dm: change max_io_len() to use blk_max_size_offset() Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 18/30] drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 19/30] bus/fsl_mc: Do not rely on caller to provide non NULL mc_io Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 20/30] power: supply: test_power: add missing newlines when printing parameters by sysfs Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 21/30] md/bitmap: md_bitmap_get_counter returns wrong blocks Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 22/30] clk: ti: clockdomain: fix static checker warning Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 23/30] net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 24/30] drivers: watchdog: rdc321x_wdt: Fix race condition bugs Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 25/30] ext4: Detect already used quota file early Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 26/30] gfs2: add validation checks for size of superblock Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 27/30] memory: emif: Remove bogus debugfs error handling Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 28/30] ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 29/30] ARM: dts: s5pv210: move PMU node out of clock controller Sasha Levin
2020-10-27 0:10 ` [PATCH AUTOSEL 4.9 30/30] ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201027001044.1027349-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox