kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/f2fs
History
Chao Yu 72c58a82e6 f2fs: fix to avoid updating zero-sized extent in extent cache 
[ Upstream commit 7c37c79510 ]

As syzbot reported:

F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0]
------------[ cut here ]------------
kernel BUG at fs/f2fs/extent_cache.c:678!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678
Call Trace:
 <TASK>
 f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085
 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline]
 f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737
 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030
 vfs_fallocate+0x669/0x7e0 fs/open.c:342
 ioctl_preallocate fs/ioctl.c:289 [inline]
 file_ioctl+0x611/0x780 fs/ioctl.c:-1
 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576
 __do_sys_ioctl fs/ioctl.c:595 [inline]
 __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f07bc58eec9

In error path of f2fs_zero_range(), it may add a zero-sized extent
into extent cache, it should be avoided.

Fixes: 6e9619499f ("f2fs: support in batch fzero in dnode page")
Cc: stable@kernel.org
Reported-by: syzbot+24124df3170c3638b35f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-f2fs-devel/68e5d698.050a0220.256323.0032.GAE@google.com
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:10:07 +01:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
checkpoint.c f2fs: fix typos in comments 2024-06-16 13:39:36 +02:00
compress.c f2fs: fix typos in comments 2024-06-16 13:39:36 +02:00
data.c f2fs: fix wrong block mapping for multi-devices 2025-10-29 14:03:15 +01:00
debug.c f2fs: use spin_lock to avoid hang 2022-04-08 14:23:58 +02:00
dir.c f2fs: Introduce linear search for dentries 2025-03-13 12:50:14 +01:00
extent_cache.c f2fs: fix KMSAN uninit-value in extent_info usage 2025-08-28 16:24:12 +02:00
f2fs.h f2fs: use global inline_xattr_slab instead of per-sb slab cache 2026-01-19 13:10:07 +01:00
file.c f2fs: fix to avoid updating zero-sized extent in extent cache 2026-01-19 13:10:07 +01:00
gc.c f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info 2024-03-26 18:21:32 -04:00
gc.h f2fs: introduce gc_merge mount option 2021-03-30 18:48:56 -07:00
hash.c f2fs: don't use casefolded comparison for "." and ".." 2022-06-09 10:23:17 +02:00
inline.c f2fs: Introduce linear search for dentries 2025-03-13 12:50:14 +01:00
inode.c f2fs: fix to do sanity check on ino and xnid 2025-08-28 16:24:31 +02:00
iostat.c f2fs: fix to avoid potential memory corruption in __update_iostat_latency() 2023-03-11 13:57:26 +01:00
iostat.h f2fs: introduce periodic iostat io latency traces 2021-08-23 10:25:51 -07:00
Kconfig f2fs: separate out iostat feature 2021-08-23 10:25:51 -07:00
Makefile f2fs: separate out iostat feature 2021-08-23 10:25:51 -07:00
namei.c f2fs: invalidate dentry cache on failed whiteout creation 2026-01-19 13:09:51 +01:00
node.c f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:24:36 +02:00
node.h f2fs: swap: support migrating swapfile in aligned write mode 2021-06-23 01:09:35 -07:00
recovery.c f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() 2026-01-19 13:10:07 +01:00
segment.c f2fs: check curseg->inited before write_sum_page in change_curseg 2024-12-14 19:51:05 +01:00
segment.h f2fs: remove struct segment_allocation default_salloc_ops 2024-12-14 19:51:05 +01:00
shrinker.c f2fs: avoid race condition for shrinker count 2020-12-03 00:59:26 -08:00
super.c f2fs: fix to propagate error from f2fs_enable_checkpoint() 2026-01-19 13:10:07 +01:00
sysfs.c f2fs: check validation of fault attrs in f2fs_build_fault_attr() 2025-05-02 07:44:24 +02:00
verity.c fs: f2fs: initialize fsdata in pagecache_write() 2023-03-11 13:57:23 +01:00
xattr.c f2fs: use global inline_xattr_slab instead of per-sb slab cache 2026-01-19 13:10:07 +01:00
xattr.h f2fs: use global inline_xattr_slab instead of per-sb slab cache 2026-01-19 13:10:07 +01:00