Messages in this thread |  | | Date | Sun, 25 Sep 2022 21:58:34 +0800 | Subject | Re: [PATCH v3] f2fs: fix to detect corrupted meta ino | From | Chao Yu <> |
| |
On 2022/9/23 2:11, Jaegeuk Kim wrote: > I modified a bit. > > https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev-test&id=a9a1592fa175baaaae43f54f175a972757c47919
Fine to me. :)
Thanks,
> > Thanks, > > On 09/22, Chao Yu wrote: >> Ping, >> >> On 2022/9/13 15:48, Chao Yu wrote: >>> It is possible that ino of dirent or orphan inode is corrupted in a >>> fuzzed image, occasionally, if corrupted ino is equal to meta ino: >>> meta_ino, node_ino or compress_ino, caller of f2fs_iget() from below >>> call paths will get meta inode directly, it's not allowed, let's >>> add sanity check to detect such cases. >>> >>> case #1 >>> - recover_dentry >>> - __f2fs_find_entry >>> - f2fs_iget_retry >>> >>> case #2 >>> - recover_orphan_inode >>> - f2fs_iget_retry >>> >>> Signed-off-by: Chao Yu <chao@kernel.org> >>> --- >>> v3: >>> - update commit title/message >>> - change logic inside f2fs_iget() rather than its caller >>> fs/f2fs/inode.c | 25 ++++++++++++++++++------- >>> 1 file changed, 18 insertions(+), 7 deletions(-) >>> >>> diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c >>> index cde0a3dc80c3..1baac6056733 100644 >>> --- a/fs/f2fs/inode.c >>> +++ b/fs/f2fs/inode.c >>> @@ -487,6 +487,12 @@ static int do_read_inode(struct inode *inode) >>> return 0; >>> } >>> +static bool is_meta_ino(struct f2fs_sb_info *sbi, unsigned int ino) >>> +{ >>> + return ino == F2FS_NODE_INO(sbi) || ino == F2FS_META_INO(sbi) || >>> + ino == F2FS_COMPRESS_INO(sbi); >>> +} >>> + >>> struct inode *f2fs_iget(struct super_block *sb, unsigned long ino) >>> { >>> struct f2fs_sb_info *sbi = F2FS_SB(sb); >>> @@ -497,17 +503,22 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned long ino) >>> if (!inode) >>> return ERR_PTR(-ENOMEM); >>> + if (is_meta_ino(sbi, ino)) { >>> + if (!(inode->i_state & I_NEW)) { >>> + f2fs_err(sbi, "detect corrupted inode no:%lu, run fsck to repair", ino); >>> + set_sbi_flag(sbi, SBI_NEED_FSCK); >>> + ret = -EFSCORRUPTED; >>> + trace_f2fs_iget_exit(inode, ret); >>> + iput(inode); >>> + return ERR_PTR(ret); >>> + } >>> + goto make_now; >>> + } >>> + >>> if (!(inode->i_state & I_NEW)) { >>> trace_f2fs_iget(inode); >>> return inode; >>> } >>> - if (ino == F2FS_NODE_INO(sbi) || ino == F2FS_META_INO(sbi)) >>> - goto make_now; >>> - >>> -#ifdef CONFIG_F2FS_FS_COMPRESSION >>> - if (ino == F2FS_COMPRESS_INO(sbi)) >>> - goto make_now; >>> -#endif >>> ret = do_read_inode(inode); >>> if (ret)
|  |