| From 1cb1b96a378e58668d3f32a89e243a358d8eefbe Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 29 Sep 2020 09:23:12 +0800 |
| Subject: f2fs: fix to check segment boundary during SIT page readahead |
| |
| From: Chao Yu <yuchao0@huawei.com> |
| |
| [ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ] |
| |
| As syzbot reported: |
| |
| kernel BUG at fs/f2fs/segment.h:657! |
| invalid opcode: 0000 [#1] PREEMPT SMP KASAN |
| CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657 |
| Call Trace: |
| build_sit_entries fs/f2fs/segment.c:4195 [inline] |
| f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779 |
| f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633 |
| mount_bdev+0x32e/0x3f0 fs/super.c:1417 |
| legacy_get_tree+0x105/0x220 fs/fs_context.c:592 |
| vfs_get_tree+0x89/0x2f0 fs/super.c:1547 |
| do_new_mount fs/namespace.c:2875 [inline] |
| path_mount+0x1387/0x2070 fs/namespace.c:3192 |
| do_mount fs/namespace.c:3205 [inline] |
| __do_sys_mount fs/namespace.c:3413 [inline] |
| __se_sys_mount fs/namespace.c:3390 [inline] |
| __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390 |
| do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 |
| entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| |
| @blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic |
| in following sanity check in current_sit_addr(), add check condition to |
| avoid this issue. |
| |
| Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com |
| Signed-off-by: Chao Yu <yuchao0@huawei.com> |
| Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/f2fs/checkpoint.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c |
| index bf190a718ca6c..0b7aec059f112 100644 |
| --- a/fs/f2fs/checkpoint.c |
| +++ b/fs/f2fs/checkpoint.c |
| @@ -243,6 +243,8 @@ int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages, |
| blkno * NAT_ENTRY_PER_BLOCK); |
| break; |
| case META_SIT: |
| + if (unlikely(blkno >= TOTAL_SEGS(sbi))) |
| + goto out; |
| /* get sit block addr */ |
| fio.new_blkaddr = current_sit_addr(sbi, |
| blkno * SIT_ENTRY_PER_BLOCK); |
| -- |
| 2.27.0 |
| |