lkml.org 
[lkml]   [2020]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.8 011/132] f2fs: fix to check segment boundary during SIT page readahead
    Date
    From: Chao Yu <yuchao0@huawei.com>

    [ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]

    As syzbot reported:

    kernel BUG at fs/f2fs/segment.h:657!
    invalid opcode: 0000 [#1] PREEMPT SMP KASAN
    CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657
    Call Trace:
    build_sit_entries fs/f2fs/segment.c:4195 [inline]
    f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779
    f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633
    mount_bdev+0x32e/0x3f0 fs/super.c:1417
    legacy_get_tree+0x105/0x220 fs/fs_context.c:592
    vfs_get_tree+0x89/0x2f0 fs/super.c:1547
    do_new_mount fs/namespace.c:2875 [inline]
    path_mount+0x1387/0x2070 fs/namespace.c:3192
    do_mount fs/namespace.c:3205 [inline]
    __do_sys_mount fs/namespace.c:3413 [inline]
    __se_sys_mount fs/namespace.c:3390 [inline]
    __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    @blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic
    in following sanity check in current_sit_addr(), add check condition to
    avoid this issue.

    Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com
    Signed-off-by: Chao Yu <yuchao0@huawei.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/f2fs/checkpoint.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
    index 95ed2b1373608..8270e924b9777 100644
    --- a/fs/f2fs/checkpoint.c
    +++ b/fs/f2fs/checkpoint.c
    @@ -243,6 +243,8 @@ int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
    blkno * NAT_ENTRY_PER_BLOCK);
    break;
    case META_SIT:
    + if (unlikely(blkno >= TOTAL_SEGS(sbi)))
    + goto out;
    /* get sit block addr */
    fio.new_blkaddr = current_sit_addr(sbi,
    blkno * SIT_ENTRY_PER_BLOCK);
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-10-27 01:30    [W:4.059 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site