From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <yuchao0@huawei.com>,
syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com,
Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 4.4 03/25] f2fs: fix to check segment boundary during SIT page readahead
Date: Mon, 26 Oct 2020 20:11:01 -0400 [thread overview]
Message-ID: <20201027001123.1027642-3-sashal@kernel.org> (raw)
In-Reply-To: <20201027001123.1027642-1-sashal@kernel.org>
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]
As syzbot reported:
kernel BUG at fs/f2fs/segment.h:657!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657
Call Trace:
build_sit_entries fs/f2fs/segment.c:4195 [inline]
f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779
f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633
mount_bdev+0x32e/0x3f0 fs/super.c:1417
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
do_new_mount fs/namespace.c:2875 [inline]
path_mount+0x1387/0x2070 fs/namespace.c:3192
do_mount fs/namespace.c:3205 [inline]
__do_sys_mount fs/namespace.c:3413 [inline]
__se_sys_mount fs/namespace.c:3390 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
@blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic
in following sanity check in current_sit_addr(), add check condition to
avoid this issue.
Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/checkpoint.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 4b2f609f376d3..047da0f105278 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -188,6 +188,8 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
blkno * NAT_ENTRY_PER_BLOCK);
break;
case META_SIT:
+ if (unlikely(blkno >= TOTAL_SEGS(sbi)))
+ goto out;
/* get sit block addr */
fio.blk_addr = current_sit_addr(sbi,
blkno * SIT_ENTRY_PER_BLOCK);
--
2.25.1
next prev parent reply other threads:[~2020-10-27 0:14 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-27 0:10 [PATCH AUTOSEL 4.4 01/25] powerpc/powernv/smp: Fix spurious DBG() warning Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 02/25] sparc64: remove mm_cpumask clearing to fix kthread_use_mm race Sasha Levin
2020-10-27 0:11 ` Sasha Levin [this message]
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 04/25] um: change sigio_spinlock to a mutex Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 05/25] xfs: fix realtime bitmap/summary file truncation when growing rt volume Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 06/25] video: fbdev: pvr2fb: initialize variables Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 07/25] ath10k: fix VHT NSS calculation when STBC is enabled Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 08/25] mmc: via-sdmmc: Fix data race bug Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 09/25] printk: reduce LOG_BUF_SHIFT range for H8300 Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 10/25] kgdb: Make "kgdbcon" work properly with "kgdb_earlycon" Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 11/25] USB: adutux: fix debugging Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 12/25] ACPI: Add out of bounds and numa_off protections to pxm_to_node() Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 13/25] dm: change max_io_len() to use blk_max_size_offset() Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 14/25] drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 15/25] power: supply: test_power: add missing newlines when printing parameters by sysfs Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 16/25] md/bitmap: md_bitmap_get_counter returns wrong blocks Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 17/25] clk: ti: clockdomain: fix static checker warning Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 18/25] net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 19/25] drivers: watchdog: rdc321x_wdt: Fix race condition bugs Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 20/25] ext4: Detect already used quota file early Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 21/25] KVM: PPC: Book3S HV: Do not allocate HPT for a nested guest Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 22/25] gfs2: add validation checks for size of superblock Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 23/25] memory: emif: Remove bogus debugfs error handling Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 24/25] ARM: dts: s5pv210: move PMU node out of clock controller Sasha Levin
2020-10-27 0:11 ` [PATCH AUTOSEL 4.4 25/25] ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201027001123.1027642-3-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox