kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/fs/f2fs
History
Chao Yu bf49527089 f2fs: fix to avoid accessing uninitialized curseg 
commit 986c50f6bc upstream.

syzbot reports a f2fs bug as below:

F2FS-fs (loop3): Stopped filesystem due to reason: 7
kworker/u8:7: attempt to access beyond end of device
BUG: unable to handle page fault for address: ffffed1604ea3dfa
RIP: 0010:get_ckpt_valid_blocks fs/f2fs/segment.h:361 [inline]
RIP: 0010:has_curseg_enough_space fs/f2fs/segment.h:570 [inline]
RIP: 0010:__get_secs_required fs/f2fs/segment.h:620 [inline]
RIP: 0010:has_not_enough_free_secs fs/f2fs/segment.h:633 [inline]
RIP: 0010:has_enough_free_secs+0x575/0x1660 fs/f2fs/segment.h:649
 <TASK>
 f2fs_is_checkpoint_ready fs/f2fs/segment.h:671 [inline]
 f2fs_write_inode+0x425/0x540 fs/f2fs/inode.c:791
 write_inode fs/fs-writeback.c:1525 [inline]
 __writeback_single_inode+0x708/0x10d0 fs/fs-writeback.c:1745
 writeback_sb_inodes+0x820/0x1360 fs/fs-writeback.c:1976
 wb_writeback+0x413/0xb80 fs/fs-writeback.c:2156
 wb_do_writeback fs/fs-writeback.c:2303 [inline]
 wb_workfn+0x410/0x1080 fs/fs-writeback.c:2343
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Commit 8b10d36537 ("f2fs: introduce FAULT_NO_SEGMENT") allows to trigger
no free segment fault in allocator, then it will update curseg->segno to
NULL_SEGNO, though, CP_ERROR_FLAG has been set, f2fs_write_inode() missed
to check the flag, and access invalid curseg->segno directly in below call
path, then resulting in panic:

- f2fs_write_inode
 - f2fs_is_checkpoint_ready
  - has_enough_free_secs
   - has_not_enough_free_secs
    - __get_secs_required
     - has_curseg_enough_space
      - get_ckpt_valid_blocks
      : access invalid curseg->segno

To avoid this issue, let's:
- check CP_ERROR_FLAG flag in prior to f2fs_is_checkpoint_ready() in
f2fs_write_inode().
- in has_curseg_enough_space(), save curseg->segno into a temp variable,
and verify its validation before use.

Fixes: 8b10d36537 ("f2fs: introduce FAULT_NO_SEGMENT")
Reported-by: syzbot+b6b347b7a4ea1b2e29b6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67973c2b.050a0220.11b1bb.0089.GAE@google.com
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-06-10 07:12:58 -04:00
..
acl.c f2fs: Use in_group_or_capable() helper 2024-06-25 11:15:48 +02:00
acl.h fs: port ->set_acl() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
checkpoint.c Revert "f2fs: rebuild nat_bits during umount" 2025-04-20 10:15:20 +02:00
compress.c f2fs: get rid of page->index 2024-09-06 23:04:48 +00:00
data.c fs/writeback: convert wbc_account_cgroup_owner to take a folio 2025-01-17 13:40:33 +01:00
debug.c f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS 2024-08-21 00:56:27 +00:00
dir.c f2fs: Introduce linear search for dentries 2025-02-08 09:58:11 +01:00
extent_cache.c f2fs: add a sysfs node to limit max read extent count per-inode 2024-12-14 20:04:06 +01:00
f2fs.h Revert "f2fs: rebuild nat_bits during umount" 2025-04-20 10:15:20 +02:00
file.c f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode 2024-12-05 14:02:23 +01:00
gc.c f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID 2024-12-05 14:02:22 +01:00
gc.h f2fs: add valid block ratio not to do excessive GC for one time GC 2024-09-11 03:33:08 +00:00
hash.c f2fs: don't use casefolded comparison for "." and ".." 2022-05-17 11:19:23 -07:00
inline.c f2fs: Introduce linear search for dentries 2025-02-08 09:58:11 +01:00
inode.c f2fs: fix to avoid accessing uninitialized curseg 2025-06-10 07:12:58 -04:00
iostat.c f2fs: add async reset zone command support 2023-06-12 13:04:09 -07:00
iostat.h f2fs: use iostat_lat_type directly as a parameter in the iostat_update_and_unbind_ctx() 2023-02-07 10:39:28 -08:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile f2fs: separate out iostat feature 2021-08-23 10:25:51 -07:00
namei.c f2fs: get rid of online repaire on corrupted directory 2024-09-11 03:30:27 +00:00
node.c Revert "f2fs: rebuild nat_bits during umount" 2025-04-20 10:15:20 +02:00
node.h f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC 2024-02-27 09:41:12 -08:00
recovery.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
segment.c f2fs: fix to drop all discards after creating snapshot on lvm device 2024-12-09 10:41:05 +01:00
segment.h f2fs: fix to avoid accessing uninitialized curseg 2025-06-10 07:12:58 -04:00
shrinker.c f2fs: add block_age-based extent cache 2022-12-12 14:53:56 -08:00
super.c f2fs: fix to avoid atomicity corruption of atomic file 2025-04-20 10:15:42 +02:00
sysfs.c f2fs: introduce f2fs_base_attr for global sysfs entries 2025-05-29 11:03:00 +02:00
verity.c f2fs-6.12-rc1 2024-09-24 15:12:38 -07:00
xattr.c f2fs: reduce expensive checkpoint trigger frequency 2024-08-15 15:26:39 +00:00
xattr.h f2fs: move f2fs_xattr_handlers and f2fs_xattr_handler_map to .rodata 2023-10-09 16:24:18 +02:00