Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Chao Yu c99860f9a7 f2fs: fix to do sanity check on summary info ... commit c6ad7fd16657ebd34a87a97d9588195aae87597d upstream. As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216456 BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 [f2fs] Read of size 4 at addr ffff8881464dcd80 by task mount/1013 CPU: 3 PID: 1013 Comm: mount Tainted: G W 6.0.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x5e print_report.cold+0xf3/0x68d kasan_report+0xa8/0x130 recover_data+0x63ae/0x6ae0 [f2fs] f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs] f2fs_fill_super+0x4665/0x61e0 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is: in fuzzed image, SSA table is corrupted: ofs_in_node is larger than ADDRS_PER_PAGE(), result in out-of-range access on 4k-size page. - recover_data - do_recover_data - check_index_in_prev_nodes - f2fs_data_blkaddr This patch adds sanity check on summary info in recovery and GC flow in where the flows rely on them. After patch: [ 29.310883] F2FS-fs (loop0): Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018 Cc: stable@vger.kernel.org Reported-by: Wenqing Liu <wenqingliu0120@gmail.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-10-26 13:22:17 +02:00
..
acl.c
acl.h
checkpoint.c	f2fs: fix to do sanity check on destination blkaddr during recovery	2022-10-26 13:22:17 +02:00
data.c	f2fs: fix to avoid potential deadlock	2022-04-15 14:18:06 +02:00
debug.c	f2fs: avoid race condition for shrinker count	2021-01-06 14:48:40 +01:00
dir.c	f2fs: reduce the scope of setting fsck tag when de->name_len is zero	2021-09-22 12:26:23 +02:00
extent_cache.c
f2fs.h	f2fs: fix to do sanity check on destination blkaddr during recovery	2022-10-26 13:22:17 +02:00
file.c	f2fs: fix fallocate to use file_modified to update permissions consistently	2022-06-14 18:11:44 +02:00
gc.c	f2fs: fix to do sanity check on summary info	2022-10-26 13:22:17 +02:00
gc.h
hash.c
inline.c	f2fs: fix a redundant call to f2fs_balance_fs if an error occurs	2021-05-19 10:08:25 +02:00
inode.c	f2fs: fix to clear dirty inode in f2fs_evict_inode()	2022-06-14 18:11:44 +02:00
Kconfig
Makefile
namei.c	f2fs: should use GFP_NOFS for directory inodes	2021-11-17 09:48:49 +01:00
node.c	f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()	2022-08-25 11:18:38 +02:00
node.h	f2fs: avoid race condition for shrinker count	2021-01-06 14:48:40 +01:00
recovery.c	f2fs: fix to do sanity check on summary info	2022-10-26 13:22:17 +02:00
segment.c	f2fs: fix dereference of stale list iterator after loop body	2022-06-14 18:11:42 +02:00
segment.h	f2fs: fix deadloop in foreground GC	2022-06-14 18:11:44 +02:00
shrinker.c	f2fs: avoid race condition for shrinker count	2021-01-06 14:48:40 +01:00
super.c	f2fs: increase the limit for reserve_root	2022-10-26 13:22:17 +02:00
sysfs.c	f2fs: fix to reserve space for IO align feature	2022-01-27 09:19:53 +01:00
trace.c
trace.h
verity.c	f2fs: fix error handling in f2fs_end_enable_verity()	2021-05-19 10:08:32 +02:00
xattr.c	f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()	2021-12-29 12:23:37 +01:00
xattr.h