1. 17 Dec, 2018 11 commits
    • Namhyung Kim's avatar
      pstore: Convert console write to use ->write_buf · 5c35dc00
      Namhyung Kim authored
      [ Upstream commit 70ad35db ]
      
      Maybe I'm missing something, but I don't know why it needs to copy the
      input buffer to psinfo->buf and then write.  Instead we can write the
      input buffer directly.  The only implementation that supports console
      message (i.e. ramoops) already does it for ftrace messages.
      
      For the upcoming virtio backend driver, it needs to protect psinfo->buf
      overwritten from console messages.  If it could use ->write_buf method
      instead of ->write, the problem will be solved easily.
      
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: 's avatarNamhyung Kim <namhyung@kernel.org>
      Signed-off-by: 's avatarKees Cook <keescook@chromium.org>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      5c35dc00
    • Pan Bian's avatar
      ocfs2: fix potential use after free · 1b5620ca
      Pan Bian authored
      [ Upstream commit 164f7e586739d07eb56af6f6d66acebb11f315c8 ]
      
      ocfs2_get_dentry() calls iput(inode) to drop the reference count of
      inode, and if the reference count hits 0, inode is freed.  However, in
      this function, it then reads inode->i_generation, which may result in a
      use after free bug.  Move the put operation later.
      
      Link: http://lkml.kernel.org/r/1543109237-110227-1-git-send-email-bianpan2016@163.com
      Fixes: 781f200c("ocfs2: Remove masklog ML_EXPORT.")
      Signed-off-by: 's avatarPan Bian <bianpan2016@163.com>
      Reviewed-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Cc: Changwei Ge <ge.changwei@h3c.com>
      Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      1b5620ca
    • Pan Bian's avatar
      hfsplus: do not free node before using · 7f0a62fb
      Pan Bian authored
      [ Upstream commit c7d7d620dcbd2a1c595092280ca943f2fced7bbd ]
      
      hfs_bmap_free() frees node via hfs_bnode_put(node).  However it then
      reads node->this when dumping error message on an error path, which may
      result in a use-after-free bug.  This patch frees node only when it is
      never used.
      
      Link: http://lkml.kernel.org/r/1543053441-66942-1-git-send-email-bianpan2016@163.comSigned-off-by: 's avatarPan Bian <bianpan2016@163.com>
      Reviewed-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Viacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      7f0a62fb
    • Pan Bian's avatar
      hfs: do not free node before using · 5cf41549
      Pan Bian authored
      [ Upstream commit ce96a407adef126870b3f4a1b73529dd8aa80f49 ]
      
      hfs_bmap_free() frees the node via hfs_bnode_put(node).  However, it
      then reads node->this when dumping error message on an error path, which
      may result in a use-after-free bug.  This patch frees the node only when
      it is never again used.
      
      Link: http://lkml.kernel.org/r/1542963889-128825-1-git-send-email-bianpan2016@163.com
      Fixes: a1185ffa2fc ("HFS rewrite")
      Signed-off-by: 's avatarPan Bian <bianpan2016@163.com>
      Reviewed-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Joe Perches <joe@perches.com>
      Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
      Cc: Viacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      5cf41549
    • Larry Chen's avatar
      ocfs2: fix deadlock caused by ocfs2_defrag_extent() · 12daef1d
      Larry Chen authored
      [ Upstream commit e21e57445a64598b29a6f629688f9b9a39e7242a ]
      
      ocfs2_defrag_extent may fall into deadlock.
      
      ocfs2_ioctl_move_extents
          ocfs2_ioctl_move_extents
            ocfs2_move_extents
              ocfs2_defrag_extent
                ocfs2_lock_allocators_move_extents
      
                  ocfs2_reserve_clusters
                    inode_lock GLOBAL_BITMAP_SYSTEM_INODE
      
      	  __ocfs2_flush_truncate_log
                    inode_lock GLOBAL_BITMAP_SYSTEM_INODE
      
      As backtrace shows above, ocfs2_reserve_clusters() will call inode_lock
      against the global bitmap if local allocator has not sufficient cluters.
      Once global bitmap could meet the demand, ocfs2_reserve_cluster will
      return success with global bitmap locked.
      
      After ocfs2_reserve_cluster(), if truncate log is full,
      __ocfs2_flush_truncate_log() will definitely fall into deadlock because
      it needs to inode_lock global bitmap, which has already been locked.
      
      To fix this bug, we could remove from
      ocfs2_lock_allocators_move_extents() the code which intends to lock
      global allocator, and put the removed code after
      __ocfs2_flush_truncate_log().
      
      ocfs2_lock_allocators_move_extents() is referred by 2 places, one is
      here, the other does not need the data allocator context, which means
      this patch does not affect the caller so far.
      
      Link: http://lkml.kernel.org/r/20181101071422.14470-1-lchen@suse.comSigned-off-by: 's avatarLarry Chen <lchen@suse.com>
      Reviewed-by: 's avatarChangwei Ge <ge.changwei@h3c.com>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      12daef1d
    • Colin Ian King's avatar
      fscache, cachefiles: remove redundant variable 'cache' · f23fc42a
      Colin Ian King authored
      [ Upstream commit 31ffa563833576bd49a8bf53120568312755e6e2 ]
      
      Variable 'cache' is being assigned but is never used hence it is
      redundant and can be removed.
      
      Cleans up clang warning:
      warning: variable 'cache' set but not used [-Wunused-but-set-variable]
      Signed-off-by: 's avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      f23fc42a
    • NeilBrown's avatar
      fscache: fix race between enablement and dropping of object · 7a821a9a
      NeilBrown authored
      [ Upstream commit c5a94f434c82529afda290df3235e4d85873c5b4 ]
      
      It was observed that a process blocked indefintely in
      __fscache_read_or_alloc_page(), waiting for FSCACHE_COOKIE_LOOKING_UP
      to be cleared via fscache_wait_for_deferred_lookup().
      
      At this time, ->backing_objects was empty, which would normaly prevent
      __fscache_read_or_alloc_page() from getting to the point of waiting.
      This implies that ->backing_objects was cleared *after*
      __fscache_read_or_alloc_page was was entered.
      
      When an object is "killed" and then "dropped",
      FSCACHE_COOKIE_LOOKING_UP is cleared in fscache_lookup_failure(), then
      KILL_OBJECT and DROP_OBJECT are "called" and only in DROP_OBJECT is
      ->backing_objects cleared.  This leaves a window where
      something else can set FSCACHE_COOKIE_LOOKING_UP and
      __fscache_read_or_alloc_page() can start waiting, before
      ->backing_objects is cleared
      
      There is some uncertainty in this analysis, but it seems to be fit the
      observations.  Adding the wake in this patch will be handled correctly
      by __fscache_read_or_alloc_page(), as it checks if ->backing_objects
      is empty again, after waiting.
      
      Customer which reported the hang, also report that the hang cannot be
      reproduced with this fix.
      
      The backtrace for the blocked process looked like:
      
      PID: 29360  TASK: ffff881ff2ac0f80  CPU: 3   COMMAND: "zsh"
       #0 [ffff881ff43efbf8] schedule at ffffffff815e56f1
       #1 [ffff881ff43efc58] bit_wait at ffffffff815e64ed
       #2 [ffff881ff43efc68] __wait_on_bit at ffffffff815e61b8
       #3 [ffff881ff43efca0] out_of_line_wait_on_bit at ffffffff815e625e
       #4 [ffff881ff43efd08] fscache_wait_for_deferred_lookup at ffffffffa04f2e8f [fscache]
       #5 [ffff881ff43efd18] __fscache_read_or_alloc_page at ffffffffa04f2ffe [fscache]
       #6 [ffff881ff43efd58] __nfs_readpage_from_fscache at ffffffffa0679668 [nfs]
       #7 [ffff881ff43efd78] nfs_readpage at ffffffffa067092b [nfs]
       #8 [ffff881ff43efda0] generic_file_read_iter at ffffffff81187a73
       #9 [ffff881ff43efe50] nfs_file_read at ffffffffa066544b [nfs]
      #10 [ffff881ff43efe70] __vfs_read at ffffffff811fc756
      #11 [ffff881ff43efee8] vfs_read at ffffffff811fccfa
      #12 [ffff881ff43eff18] sys_read at ffffffff811fda62
      #13 [ffff881ff43eff50] entry_SYSCALL_64_fastpath at ffffffff815e986e
      Signed-off-by: 's avatarNeilBrown <neilb@suse.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      7a821a9a
    • Kiran Kumar Modukuri's avatar
      cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active · 5e3cd966
      Kiran Kumar Modukuri authored
      [ Upstream commit 9a24ce5b66f9c8190d63b15f4473600db4935f1f ]
      
      [Description]
      
      In a heavily loaded system where the system pagecache is nearing memory
      limits and fscache is enabled, pages can be leaked by fscache while trying
      read pages from cachefiles backend.  This can happen because two
      applications can be reading same page from a single mount, two threads can
      be trying to read the backing page at same time.  This results in one of
      the threads finding that a page for the backing file or netfs file is
      already in the radix tree.  During the error handling cachefiles does not
      clean up the reference on backing page, leading to page leak.
      
      [Fix]
      The fix is straightforward, to decrement the reference when error is
      encountered.
      
        [dhowells: Note that I've removed the clearance and put of newpage as
         they aren't attested in the commit message and don't appear to actually
         achieve anything since a new page is only allocated is newpage!=NULL and
         any residual new page is cleared before returning.]
      
      [Testing]
      I have tested the fix using following method for 12+ hrs.
      
      1) mkdir -p /mnt/nfs ; mount -o vers=3,fsc <server_ip>:/export /mnt/nfs
      2) create 10000 files of 2.8MB in a NFS mount.
      3) start a thread to simulate heavy VM presssure
         (while true ; do echo 3 > /proc/sys/vm/drop_caches ; sleep 1 ; done)&
      4) start multiple parallel reader for data set at same time
         find /mnt/nfs -type f | xargs -P 80 cat > /dev/null &
         find /mnt/nfs -type f | xargs -P 80 cat > /dev/null &
         find /mnt/nfs -type f | xargs -P 80 cat > /dev/null &
         ..
         ..
         find /mnt/nfs -type f | xargs -P 80 cat > /dev/null &
         find /mnt/nfs -type f | xargs -P 80 cat > /dev/null &
      5) finally check using cat /proc/fs/fscache/stats | grep -i pages ;
         free -h , cat /proc/meminfo and page-types -r -b lru
         to ensure all pages are freed.
      Reviewed-by: 's avatarDaniel Axtens <dja@axtens.net>
      Signed-off-by: 's avatarShantanu Goel <sgoel01@yahoo.com>
      Signed-off-by: 's avatarKiran Kumar Modukuri <kiran.modukuri@gmail.com>
      [dja: forward ported to current upstream]
      Signed-off-by: 's avatarDaniel Axtens <dja@axtens.net>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      5e3cd966
    • Pan Bian's avatar
      exportfs: do not read dentry after free · d2139ee7
      Pan Bian authored
      [ Upstream commit 2084ac6c505a58f7efdec13eba633c6aaa085ca5 ]
      
      The function dentry_connected calls dput(dentry) to drop the previously
      acquired reference to dentry. In this case, dentry can be released.
      After that, IS_ROOT(dentry) checks the condition
      (dentry == dentry->d_parent), which may result in a use-after-free bug.
      This patch directly compares dentry with its parent obtained before
      dropping the reference.
      
      Fixes: a056cc89("exportfs: stop retrying once we race with
      rename/remove")
      Signed-off-by: 's avatarPan Bian <bianpan2016@163.com>
      Signed-off-by: 's avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      d2139ee7
    • Robbie Ko's avatar
      Btrfs: send, fix infinite loop due to directory rename dependencies · aeda9163
      Robbie Ko authored
      [ Upstream commit a4390aee72713d9e73f1132bcdeb17d72fbbf974 ]
      
      When doing an incremental send, due to the need of delaying directory move
      (rename) operations we can end up in infinite loop at
      apply_children_dir_moves().
      
      An example scenario that triggers this problem is described below, where
      directory names correspond to the numbers of their respective inodes.
      
      Parent snapshot:
      
       .
       |--- 261/
             |--- 271/
                   |--- 266/
                         |--- 259/
                         |--- 260/
                         |     |--- 267
                         |
                         |--- 264/
                         |     |--- 258/
                         |           |--- 257/
                         |
                         |--- 265/
                         |--- 268/
                         |--- 269/
                         |     |--- 262/
                         |
                         |--- 270/
                         |--- 272/
                         |     |--- 263/
                         |     |--- 275/
                         |
                         |--- 274/
                               |--- 273/
      
      Send snapshot:
      
       .
       |-- 275/
            |-- 274/
                 |-- 273/
                      |-- 262/
                           |-- 269/
                                |-- 258/
                                     |-- 271/
                                          |-- 268/
                                               |-- 267/
                                                    |-- 270/
                                                         |-- 259/
                                                         |    |-- 265/
                                                         |
                                                         |-- 272/
                                                              |-- 257/
                                                                   |-- 260/
                                                                   |-- 264/
                                                                        |-- 263/
                                                                             |-- 261/
                                                                                  |-- 266/
      
      When processing inode 257 we delay its move (rename) operation because its
      new parent in the send snapshot, inode 272, was not yet processed. Then
      when processing inode 272, we delay the move operation for that inode
      because inode 274 is its ancestor in the send snapshot. Finally we delay
      the move operation for inode 274 when processing it because inode 275 is
      its new parent in the send snapshot and was not yet moved.
      
      When finishing processing inode 275, we start to do the move operations
      that were previously delayed (at apply_children_dir_moves()), resulting in
      the following iterations:
      
      1) We issue the move operation for inode 274;
      
      2) Because inode 262 depended on the move operation of inode 274 (it was
         delayed because 274 is its ancestor in the send snapshot), we issue the
         move operation for inode 262;
      
      3) We issue the move operation for inode 272, because it was delayed by
         inode 274 too (ancestor of 272 in the send snapshot);
      
      4) We issue the move operation for inode 269 (it was delayed by 262);
      
      5) We issue the move operation for inode 257 (it was delayed by 272);
      
      6) We issue the move operation for inode 260 (it was delayed by 272);
      
      7) We issue the move operation for inode 258 (it was delayed by 269);
      
      8) We issue the move operation for inode 264 (it was delayed by 257);
      
      9) We issue the move operation for inode 271 (it was delayed by 258);
      
      10) We issue the move operation for inode 263 (it was delayed by 264);
      
      11) We issue the move operation for inode 268 (it was delayed by 271);
      
      12) We verify if we can issue the move operation for inode 270 (it was
          delayed by 271). We detect a path loop in the current state, because
          inode 267 needs to be moved first before we can issue the move
          operation for inode 270. So we delay again the move operation for
          inode 270, this time we will attempt to do it after inode 267 is
          moved;
      
      13) We issue the move operation for inode 261 (it was delayed by 263);
      
      14) We verify if we can issue the move operation for inode 266 (it was
          delayed by 263). We detect a path loop in the current state, because
          inode 270 needs to be moved first before we can issue the move
          operation for inode 266. So we delay again the move operation for
          inode 266, this time we will attempt to do it after inode 270 is
          moved (its move operation was delayed in step 12);
      
      15) We issue the move operation for inode 267 (it was delayed by 268);
      
      16) We verify if we can issue the move operation for inode 266 (it was
          delayed by 270). We detect a path loop in the current state, because
          inode 270 needs to be moved first before we can issue the move
          operation for inode 266. So we delay again the move operation for
          inode 266, this time we will attempt to do it after inode 270 is
          moved (its move operation was delayed in step 12). So here we added
          again the same delayed move operation that we added in step 14;
      
      17) We attempt again to see if we can issue the move operation for inode
          266, and as in step 16, we realize we can not due to a path loop in
          the current state due to a dependency on inode 270. Again we delay
          inode's 266 rename to happen after inode's 270 move operation, adding
          the same dependency to the empty stack that we did in steps 14 and 16.
          The next iteration will pick the same move dependency on the stack
          (the only entry) and realize again there is still a path loop and then
          again the same dependency to the stack, over and over, resulting in
          an infinite loop.
      
      So fix this by preventing adding the same move dependency entries to the
      stack by removing each pending move record from the red black tree of
      pending moves. This way the next call to get_pending_dir_moves() will
      not return anything for the current parent inode.
      
      A test case for fstests, with this reproducer, follows soon.
      Signed-off-by: 's avatarRobbie Ko <robbieko@synology.com>
      Reviewed-by: 's avatarFilipe Manana <fdmanana@suse.com>
      [Wrote changelog with example and more clear explanation]
      Signed-off-by: 's avatarFilipe Manana <fdmanana@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      aeda9163
    • YueHaibing's avatar
      sysv: return 'err' instead of 0 in __sysv_write_inode · c36dff34
      YueHaibing authored
      [ Upstream commit c4b7d1ba7d263b74bb72e9325262a67139605cde ]
      
      Fixes gcc '-Wunused-but-set-variable' warning:
      
      fs/sysv/inode.c: In function '__sysv_write_inode':
      fs/sysv/inode.c:239:6: warning:
       variable 'err' set but not used [-Wunused-but-set-variable]
      
      __sysv_write_inode should return 'err' instead of 0
      
      Fixes: 05459ca8 ("repair sysv_write_inode(), switch sysv to simple_fsync()")
      Signed-off-by: 's avatarYueHaibing <yuehaibing@huawei.com>
      Signed-off-by: 's avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
      c36dff34
  2. 13 Dec, 2018 1 commit
  3. 08 Dec, 2018 28 commits
    • Mike Kravetz's avatar
      hugetlbfs: fix bug in pgoff overflow checking · 0c82bca7
      Mike Kravetz authored
      commit 5df63c2a149ae65a9ec239e7c2af44efa6f79beb upstream.
      
      This is a fix for a regression in 32 bit kernels caused by an invalid
      check for pgoff overflow in hugetlbfs mmap setup.  The check incorrectly
      specified that the size of a loff_t was the same as the size of a long.
      The regression prevents mapping hugetlbfs files at offsets greater than
      4GB on 32 bit kernels.
      
      On 32 bit kernels conversion from a page based unsigned long can not
      overflow a loff_t byte offset.  Therefore, skip this check if
      sizeof(unsigned long) != sizeof(loff_t).
      
      Link: http://lkml.kernel.org/r/20180330145402.5053-1-mike.kravetz@oracle.com
      Fixes: 63489f8e8211 ("hugetlbfs: check for pgoff value overflow")
      Reported-by: 's avatarDan Rue <dan.rue@linaro.org>
      Signed-off-by: 's avatarMike Kravetz <mike.kravetz@oracle.com>
      Tested-by: 's avatarAnders Roxell <anders.roxell@linaro.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Yisheng Xie <xieyisheng1@huawei.com>
      Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: Nic Losby <blurbdust@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0c82bca7
    • Darrick J. Wong's avatar
      xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE · 4ec44e98
      Darrick J. Wong authored
      commit 7b38460dc8e4eafba06c78f8e37099d3b34d473c upstream.
      
      Kanda Motohiro reported that expanding a tiny xattr into a large xattr
      fails on XFS because we remove the tiny xattr from a shortform fork and
      then try to re-add it after converting the fork to extents format having
      not removed the ATTR_REPLACE flag.  This fails because the attr is no
      longer present, causing a fs shutdown.
      
      This is derived from the patch in his bug report, but we really
      shouldn't ignore a nonzero retval from the remove call.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199119
      Reported-by: kanda.motohiro@gmail.com
      Reviewed-by: 's avatarDave Chinner <dchinner@redhat.com>
      Reviewed-by: 's avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: 's avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4ec44e98
    • Chao Yu's avatar
      f2fs: fix to do sanity check with cp_pack_start_sum · 91fe514b
      Chao Yu authored
      commit e494c2f995d6181d6e29c4927d68e0f295ecf75b upstream.
      
      After fuzzing, cp_pack_start_sum could be corrupted, so current log's
      summary info should be wrong due to loading incorrect summary block.
      Then, if segment's type in current log is exceeded NR_CURSEG_TYPE, it
      can lead accessing invalid dirty_i->dirty_segmap bitmap finally.
      
      Add sanity check for cp_pack_start_sum to fix this issue.
      
      https://bugzilla.kernel.org/show_bug.cgi?id=200419
      
      - Reproduce
      
      - Kernel message (f2fs-dev w/ KASAN)
      [ 3117.578432] F2FS-fs (loop0): Invalid log blocks per segment (8)
      
      [ 3117.578445] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
      [ 3117.581364] F2FS-fs (loop0): invalid crc_offset: 30716
      [ 3117.583564] WARNING: CPU: 1 PID: 1225 at fs/f2fs/checkpoint.c:90 __get_meta_page+0x448/0x4b0
      [ 3117.583570] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer joydev input_leds serio_raw snd soundcore mac_hid i2c_piix4 ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi btrfs zstd_decompress zstd_compress xxhash raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear 8139too qxl ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel psmouse aes_x86_64 8139cp crypto_simd cryptd mii glue_helper pata_acpi floppy
      [ 3117.584014] CPU: 1 PID: 1225 Comm: mount Not tainted 4.17.0+ #1
      [ 3117.584017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [ 3117.584022] RIP: 0010:__get_meta_page+0x448/0x4b0
      [ 3117.584023] Code: 00 49 8d bc 24 84 00 00 00 e8 74 54 da ff 41 83 8c 24 84 00 00 00 08 4c 89 f6 4c 89 ef e8 c0 d9 95 00 48 89 ef e8 18 e3 00 00 <0f> 0b f0 80 4d 48 04 e9 0f fe ff ff 0f 0b 48 89 c7 48 89 04 24 e8
      [ 3117.584072] RSP: 0018:ffff88018eb678c0 EFLAGS: 00010286
      [ 3117.584082] RAX: ffff88018f0a6a78 RBX: ffffea0007a46600 RCX: ffffffff9314d1b2
      [ 3117.584085] RDX: ffffffff00000001 RSI: 0000000000000000 RDI: ffff88018f0a6a98
      [ 3117.584087] RBP: ffff88018ebe9980 R08: 0000000000000002 R09: 0000000000000001
      [ 3117.584090] R10: 0000000000000001 R11: ffffed00326e4450 R12: ffff880193722200
      [ 3117.584092] R13: ffff88018ebe9afc R14: 0000000000000206 R15: ffff88018eb67900
      [ 3117.584096] FS:  00007f5694636840(0000) GS:ffff8801f3b00000(0000) knlGS:0000000000000000
      [ 3117.584098] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3117.584101] CR2: 00000000016f21b8 CR3: 0000000191c22000 CR4: 00000000000006e0
      [ 3117.584112] Call Trace:
      [ 3117.584121]  ? f2fs_set_meta_page_dirty+0x150/0x150
      [ 3117.584127]  ? f2fs_build_segment_manager+0xbf9/0x3190
      [ 3117.584133]  ? f2fs_npages_for_summary_flush+0x75/0x120
      [ 3117.584145]  f2fs_build_segment_manager+0xda8/0x3190
      [ 3117.584151]  ? f2fs_get_valid_checkpoint+0x298/0xa00
      [ 3117.584156]  ? f2fs_flush_sit_entries+0x10e0/0x10e0
      [ 3117.584184]  ? map_id_range_down+0x17c/0x1b0
      [ 3117.584188]  ? __put_user_ns+0x30/0x30
      [ 3117.584206]  ? find_next_bit+0x53/0x90
      [ 3117.584237]  ? cpumask_next+0x16/0x20
      [ 3117.584249]  f2fs_fill_super+0x1948/0x2b40
      [ 3117.584258]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.584279]  ? sget_userns+0x65e/0x690
      [ 3117.584296]  ? set_blocksize+0x88/0x130
      [ 3117.584302]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.584305]  mount_bdev+0x1c0/0x200
      [ 3117.584310]  mount_fs+0x5c/0x190
      [ 3117.584320]  vfs_kern_mount+0x64/0x190
      [ 3117.584330]  do_mount+0x2e4/0x1450
      [ 3117.584343]  ? lockref_put_return+0x130/0x130
      [ 3117.584347]  ? copy_mount_string+0x20/0x20
      [ 3117.584357]  ? kasan_unpoison_shadow+0x31/0x40
      [ 3117.584362]  ? kasan_kmalloc+0xa6/0xd0
      [ 3117.584373]  ? memcg_kmem_put_cache+0x16/0x90
      [ 3117.584377]  ? __kmalloc_track_caller+0x196/0x210
      [ 3117.584383]  ? _copy_from_user+0x61/0x90
      [ 3117.584396]  ? memdup_user+0x3e/0x60
      [ 3117.584401]  ksys_mount+0x7e/0xd0
      [ 3117.584405]  __x64_sys_mount+0x62/0x70
      [ 3117.584427]  do_syscall_64+0x73/0x160
      [ 3117.584440]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [ 3117.584455] RIP: 0033:0x7f5693f14b9a
      [ 3117.584456] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
      [ 3117.584505] RSP: 002b:00007fff27346488 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
      [ 3117.584510] RAX: ffffffffffffffda RBX: 00000000016e2030 RCX: 00007f5693f14b9a
      [ 3117.584512] RDX: 00000000016e2210 RSI: 00000000016e3f30 RDI: 00000000016ee040
      [ 3117.584514] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
      [ 3117.584516] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 00000000016ee040
      [ 3117.584519] R13: 00000000016e2210 R14: 0000000000000000 R15: 0000000000000003
      [ 3117.584523] ---[ end trace a8e0d899985faf31 ]---
      [ 3117.685663] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
      [ 3117.685673] F2FS-fs (loop0): recover_data: ino = 2 (i_size: recover) recovered = 1, err = 0
      [ 3117.685707] ==================================================================
      [ 3117.685955] BUG: KASAN: slab-out-of-bounds in __remove_dirty_segment+0xdd/0x1e0
      [ 3117.686175] Read of size 8 at addr ffff88018f0a63d0 by task mount/1225
      
      [ 3117.686477] CPU: 0 PID: 1225 Comm: mount Tainted: G        W         4.17.0+ #1
      [ 3117.686481] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [ 3117.686483] Call Trace:
      [ 3117.686494]  dump_stack+0x71/0xab
      [ 3117.686512]  print_address_description+0x6b/0x290
      [ 3117.686517]  kasan_report+0x28e/0x390
      [ 3117.686522]  ? __remove_dirty_segment+0xdd/0x1e0
      [ 3117.686527]  __remove_dirty_segment+0xdd/0x1e0
      [ 3117.686532]  locate_dirty_segment+0x189/0x190
      [ 3117.686538]  f2fs_allocate_new_segments+0xa9/0xe0
      [ 3117.686543]  recover_data+0x703/0x2c20
      [ 3117.686547]  ? f2fs_recover_fsync_data+0x48f/0xd50
      [ 3117.686553]  ? ksys_mount+0x7e/0xd0
      [ 3117.686564]  ? policy_nodemask+0x1a/0x90
      [ 3117.686567]  ? policy_node+0x56/0x70
      [ 3117.686571]  ? add_fsync_inode+0xf0/0xf0
      [ 3117.686592]  ? blk_finish_plug+0x44/0x60
      [ 3117.686597]  ? f2fs_ra_meta_pages+0x38b/0x5e0
      [ 3117.686602]  ? find_inode_fast+0xac/0xc0
      [ 3117.686606]  ? f2fs_is_valid_blkaddr+0x320/0x320
      [ 3117.686618]  ? __radix_tree_lookup+0x150/0x150
      [ 3117.686633]  ? dqget+0x670/0x670
      [ 3117.686648]  ? pagecache_get_page+0x29/0x410
      [ 3117.686656]  ? kmem_cache_alloc+0x176/0x1e0
      [ 3117.686660]  ? f2fs_is_valid_blkaddr+0x11d/0x320
      [ 3117.686664]  f2fs_recover_fsync_data+0xc23/0xd50
      [ 3117.686670]  ? f2fs_space_for_roll_forward+0x60/0x60
      [ 3117.686674]  ? rb_insert_color+0x323/0x3d0
      [ 3117.686678]  ? f2fs_recover_orphan_inodes+0xa5/0x700
      [ 3117.686683]  ? proc_register+0x153/0x1d0
      [ 3117.686686]  ? f2fs_remove_orphan_inode+0x10/0x10
      [ 3117.686695]  ? f2fs_attr_store+0x50/0x50
      [ 3117.686700]  ? proc_create_single_data+0x52/0x60
      [ 3117.686707]  f2fs_fill_super+0x1d06/0x2b40
      [ 3117.686728]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.686735]  ? sget_userns+0x65e/0x690
      [ 3117.686740]  ? set_blocksize+0x88/0x130
      [ 3117.686745]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.686748]  mount_bdev+0x1c0/0x200
      [ 3117.686753]  mount_fs+0x5c/0x190
      [ 3117.686758]  vfs_kern_mount+0x64/0x190
      [ 3117.686762]  do_mount+0x2e4/0x1450
      [ 3117.686769]  ? lockref_put_return+0x130/0x130
      [ 3117.686773]  ? copy_mount_string+0x20/0x20
      [ 3117.686777]  ? kasan_unpoison_shadow+0x31/0x40
      [ 3117.686780]  ? kasan_kmalloc+0xa6/0xd0
      [ 3117.686786]  ? memcg_kmem_put_cache+0x16/0x90
      [ 3117.686790]  ? __kmalloc_track_caller+0x196/0x210
      [ 3117.686795]  ? _copy_from_user+0x61/0x90
      [ 3117.686801]  ? memdup_user+0x3e/0x60
      [ 3117.686804]  ksys_mount+0x7e/0xd0
      [ 3117.686809]  __x64_sys_mount+0x62/0x70
      [ 3117.686816]  do_syscall_64+0x73/0x160
      [ 3117.686824]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [ 3117.686829] RIP: 0033:0x7f5693f14b9a
      [ 3117.686830] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
      [ 3117.686887] RSP: 002b:00007fff27346488 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
      [ 3117.686892] RAX: ffffffffffffffda RBX: 00000000016e2030 RCX: 00007f5693f14b9a
      [ 3117.686894] RDX: 00000000016e2210 RSI: 00000000016e3f30 RDI: 00000000016ee040
      [ 3117.686896] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
      [ 3117.686899] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 00000000016ee040
      [ 3117.686901] R13: 00000000016e2210 R14: 0000000000000000 R15: 0000000000000003
      
      [ 3117.687005] Allocated by task 1225:
      [ 3117.687152]  kasan_kmalloc+0xa6/0xd0
      [ 3117.687157]  kmem_cache_alloc_trace+0xfd/0x200
      [ 3117.687161]  f2fs_build_segment_manager+0x2d09/0x3190
      [ 3117.687165]  f2fs_fill_super+0x1948/0x2b40
      [ 3117.687168]  mount_bdev+0x1c0/0x200
      [ 3117.687171]  mount_fs+0x5c/0x190
      [ 3117.687174]  vfs_kern_mount+0x64/0x190
      [ 3117.687177]  do_mount+0x2e4/0x1450
      [ 3117.687180]  ksys_mount+0x7e/0xd0
      [ 3117.687182]  __x64_sys_mount+0x62/0x70
      [ 3117.687186]  do_syscall_64+0x73/0x160
      [ 3117.687190]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      [ 3117.687285] Freed by task 19:
      [ 3117.687412]  __kasan_slab_free+0x137/0x190
      [ 3117.687416]  kfree+0x8b/0x1b0
      [ 3117.687460]  ttm_bo_man_put_node+0x61/0x80 [ttm]
      [ 3117.687476]  ttm_bo_cleanup_refs+0x15f/0x250 [ttm]
      [ 3117.687492]  ttm_bo_delayed_delete+0x2f0/0x300 [ttm]
      [ 3117.687507]  ttm_bo_delayed_workqueue+0x17/0x50 [ttm]
      [ 3117.687528]  process_one_work+0x2f9/0x740
      [ 3117.687531]  worker_thread+0x78/0x6b0
      [ 3117.687541]  kthread+0x177/0x1c0
      [ 3117.687545]  ret_from_fork+0x35/0x40
      
      [ 3117.687638] The buggy address belongs to the object at ffff88018f0a6300
                      which belongs to the cache kmalloc-192 of size 192
      [ 3117.688014] The buggy address is located 16 bytes to the right of
                      192-byte region [ffff88018f0a6300, ffff88018f0a63c0)
      [ 3117.688382] The buggy address belongs to the page:
      [ 3117.688554] page:ffffea00063c2980 count:1 mapcount:0 mapping:ffff8801f3403180 index:0x0
      [ 3117.688788] flags: 0x17fff8000000100(slab)
      [ 3117.688944] raw: 017fff8000000100 ffffea00063c2840 0000000e0000000e ffff8801f3403180
      [ 3117.689166] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
      [ 3117.689386] page dumped because: kasan: bad access detected
      
      [ 3117.689653] Memory state around the buggy address:
      [ 3117.689816]  ffff88018f0a6280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3117.690027]  ffff88018f0a6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [ 3117.690239] >ffff88018f0a6380: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [ 3117.690448]                                                  ^
      [ 3117.690644]  ffff88018f0a6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [ 3117.690868]  ffff88018f0a6480: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [ 3117.691077] ==================================================================
      [ 3117.691290] Disabling lock debugging due to kernel taint
      [ 3117.693893] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
      [ 3117.694120] PGD 80000001f01bc067 P4D 80000001f01bc067 PUD 1d9638067 PMD 0
      [ 3117.694338] Oops: 0002 [#1] SMP KASAN PTI
      [ 3117.694490] CPU: 1 PID: 1225 Comm: mount Tainted: G    B   W         4.17.0+ #1
      [ 3117.694703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [ 3117.695073] RIP: 0010:__remove_dirty_segment+0xe2/0x1e0
      [ 3117.695246] Code: c4 48 89 c7 e8 cf bb d7 ff 45 0f b6 24 24 41 83 e4 3f 44 88 64 24 07 41 83 e4 3f 4a 8d 7c e3 08 e8 b3 bc d7 ff 4a 8b 4c e3 08 <f0> 4c 0f b3 29 0f 82 94 00 00 00 48 8d bd 20 04 00 00 e8 97 bb d7
      [ 3117.695793] RSP: 0018:ffff88018eb67638 EFLAGS: 00010292
      [ 3117.695969] RAX: 0000000000000000 RBX: ffff88018f0a6300 RCX: 0000000000000000
      [ 3117.696182] RDX: 0000000000000000 RSI: 0000000000000297 RDI: 0000000000000297
      [ 3117.696391] RBP: ffff88018ebe9980 R08: ffffed003e743ebb R09: ffffed003e743ebb
      [ 3117.696604] R10: 0000000000000001 R11: ffffed003e743eba R12: 0000000000000019
      [ 3117.696813] R13: 0000000000000014 R14: 0000000000000320 R15: ffff88018ebe99e0
      [ 3117.697032] FS:  00007f5694636840(0000) GS:ffff8801f3b00000(0000) knlGS:0000000000000000
      [ 3117.697280] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3117.702357] CR2: 00007fe89bb1a000 CR3: 0000000191c22000 CR4: 00000000000006e0
      [ 3117.707235] Call Trace:
      [ 3117.712077]  locate_dirty_segment+0x189/0x190
      [ 3117.716891]  f2fs_allocate_new_segments+0xa9/0xe0
      [ 3117.721617]  recover_data+0x703/0x2c20
      [ 3117.726316]  ? f2fs_recover_fsync_data+0x48f/0xd50
      [ 3117.730957]  ? ksys_mount+0x7e/0xd0
      [ 3117.735573]  ? policy_nodemask+0x1a/0x90
      [ 3117.740198]  ? policy_node+0x56/0x70
      [ 3117.744829]  ? add_fsync_inode+0xf0/0xf0
      [ 3117.749487]  ? blk_finish_plug+0x44/0x60
      [ 3117.754152]  ? f2fs_ra_meta_pages+0x38b/0x5e0
      [ 3117.758831]  ? find_inode_fast+0xac/0xc0
      [ 3117.763448]  ? f2fs_is_valid_blkaddr+0x320/0x320
      [ 3117.768046]  ? __radix_tree_lookup+0x150/0x150
      [ 3117.772603]  ? dqget+0x670/0x670
      [ 3117.777159]  ? pagecache_get_page+0x29/0x410
      [ 3117.781648]  ? kmem_cache_alloc+0x176/0x1e0
      [ 3117.786067]  ? f2fs_is_valid_blkaddr+0x11d/0x320
      [ 3117.790476]  f2fs_recover_fsync_data+0xc23/0xd50
      [ 3117.794790]  ? f2fs_space_for_roll_forward+0x60/0x60
      [ 3117.799086]  ? rb_insert_color+0x323/0x3d0
      [ 3117.803304]  ? f2fs_recover_orphan_inodes+0xa5/0x700
      [ 3117.807563]  ? proc_register+0x153/0x1d0
      [ 3117.811766]  ? f2fs_remove_orphan_inode+0x10/0x10
      [ 3117.815947]  ? f2fs_attr_store+0x50/0x50
      [ 3117.820087]  ? proc_create_single_data+0x52/0x60
      [ 3117.824262]  f2fs_fill_super+0x1d06/0x2b40
      [ 3117.828367]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.832432]  ? sget_userns+0x65e/0x690
      [ 3117.836500]  ? set_blocksize+0x88/0x130
      [ 3117.840501]  ? f2fs_commit_super+0x1a0/0x1a0
      [ 3117.844420]  mount_bdev+0x1c0/0x200
      [ 3117.848275]  mount_fs+0x5c/0x190
      [ 3117.852053]  vfs_kern_mount+0x64/0x190
      [ 3117.855810]  do_mount+0x2e4/0x1450
      [ 3117.859441]  ? lockref_put_return+0x130/0x130
      [ 3117.862996]  ? copy_mount_string+0x20/0x20
      [ 3117.866417]  ? kasan_unpoison_shadow+0x31/0x40
      [ 3117.869719]  ? kasan_kmalloc+0xa6/0xd0
      [ 3117.872948]  ? memcg_kmem_put_cache+0x16/0x90
      [ 3117.876121]  ? __kmalloc_track_caller+0x196/0x210
      [ 3117.879333]  ? _copy_from_user+0x61/0x90
      [ 3117.882467]  ? memdup_user+0x3e/0x60
      [ 3117.885604]  ksys_mount+0x7e/0xd0
      [ 3117.888700]  __x64_sys_mount+0x62/0x70
      [ 3117.891742]  do_syscall_64+0x73/0x160
      [ 3117.894692]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [ 3117.897669] RIP: 0033:0x7f5693f14b9a
      [ 3117.900563] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
      [ 3117.906922] RSP: 002b:00007fff27346488 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
      [ 3117.910159] RAX: ffffffffffffffda RBX: 00000000016e2030 RCX: 00007f5693f14b9a
      [ 3117.913469] RDX: 00000000016e2210 RSI: 00000000016e3f30 RDI: 00000000016ee040
      [ 3117.916764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
      [ 3117.920071] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 00000000016ee040
      [ 3117.923393] R13: 00000000016e2210 R14: 0000000000000000 R15: 0000000000000003
      [ 3117.926680] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer joydev input_leds serio_raw snd soundcore mac_hid i2c_piix4 ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi btrfs zstd_decompress zstd_compress xxhash raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear 8139too qxl ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel psmouse aes_x86_64 8139cp crypto_simd cryptd mii glue_helper pata_acpi floppy
      [ 3117.949979] CR2: 0000000000000000
      [ 3117.954283] ---[ end trace a8e0d899985faf32 ]---
      [ 3117.958575] RIP: 0010:__remove_dirty_segment+0xe2/0x1e0
      [ 3117.962810] Code: c4 48 89 c7 e8 cf bb d7 ff 45 0f b6 24 24 41 83 e4 3f 44 88 64 24 07 41 83 e4 3f 4a 8d 7c e3 08 e8 b3 bc d7 ff 4a 8b 4c e3 08 <f0> 4c 0f b3 29 0f 82 94 00 00 00 48 8d bd 20 04 00 00 e8 97 bb d7
      [ 3117.971789] RSP: 0018:ffff88018eb67638 EFLAGS: 00010292
      [ 3117.976333] RAX: 0000000000000000 RBX: ffff88018f0a6300 RCX: 0000000000000000
      [ 3117.980926] RDX: 0000000000000000 RSI: 0000000000000297 RDI: 0000000000000297
      [ 3117.985497] RBP: ffff88018ebe9980 R08: ffffed003e743ebb R09: ffffed003e743ebb
      [ 3117.990098] R10: 0000000000000001 R11: ffffed003e743eba R12: 0000000000000019
      [ 3117.994761] R13: 0000000000000014 R14: 0000000000000320 R15: ffff88018ebe99e0
      [ 3117.999392] FS:  00007f5694636840(0000) GS:ffff8801f3b00000(0000) knlGS:0000000000000000
      [ 3118.004096] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3118.008816] CR2: 00007fe89bb1a000 CR3: 0000000191c22000 CR4: 00000000000006e0
      
      - Location
      https://elixir.bootlin.com/linux/v4.18-rc3/source/fs/f2fs/segment.c#L775
      		if (test_and_clear_bit(segno, dirty_i->dirty_segmap[t]))
      			dirty_i->nr_dirty[t]--;
      Here dirty_i->dirty_segmap[t] can be NULL which leads to crash in test_and_clear_bit()
      
      Reported-by Wen Xu <wen.xu@gatech.edu>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: The function is called sanity_check_ckpt()]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      91fe514b
    • Jaegeuk Kim's avatar
      f2fs: free meta pages if sanity check for ckpt is failed · 2c605dd1
      Jaegeuk Kim authored
      commit a2125ff7 upstream.
      
      This fixes missing freeing meta pages in the error case.
      Tested-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2c605dd1
    • Chao Yu's avatar
      f2fs: fix to do sanity check with block address in main area v2 · b10a6ac2
      Chao Yu authored
      commit 91291e9998d208370eb8156c760691b873bd7522 upstream.
      
      This patch adds f2fs_is_valid_blkaddr() in below functions to do sanity
      check with block address to avoid pentential panic:
      - f2fs_grab_read_bio()
      - __written_first_block()
      
      https://bugzilla.kernel.org/show_bug.cgi?id=200465
      
      - Reproduce
      
      - POC (poc.c)
          #define _GNU_SOURCE
          #include <sys/types.h>
          #include <sys/mount.h>
          #include <sys/mman.h>
          #include <sys/stat.h>
          #include <sys/xattr.h>
      
          #include <dirent.h>
          #include <errno.h>
          #include <error.h>
          #include <fcntl.h>
          #include <stdio.h>
          #include <stdlib.h>
          #include <string.h>
          #include <unistd.h>
      
          #include <linux/falloc.h>
          #include <linux/loop.h>
      
          static void activity(char *mpoint) {
      
            char *xattr;
            int err;
      
            err = asprintf(&xattr, "%s/foo/bar/xattr", mpoint);
      
            char buf2[113];
            memset(buf2, 0, sizeof(buf2));
            listxattr(xattr, buf2, sizeof(buf2));
      
          }
      
          int main(int argc, char *argv[]) {
            activity(argv[1]);
            return 0;
          }
      
      - kernel message
      [  844.718738] F2FS-fs (loop0): Mounted with checkpoint version = 2
      [  846.430929] F2FS-fs (loop0): access invalid blkaddr:1024
      [  846.431058] WARNING: CPU: 1 PID: 1249 at fs/f2fs/checkpoint.c:154 f2fs_is_valid_blkaddr+0x10f/0x160
      [  846.431059] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd input_leds joydev soundcore serio_raw i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear qxl ttm crct10dif_pclmul crc32_pclmul drm_kms_helper ghash_clmulni_intel syscopyarea sysfillrect sysimgblt fb_sys_fops pcbc drm 8139too aesni_intel 8139cp floppy psmouse mii aes_x86_64 crypto_simd pata_acpi cryptd glue_helper
      [  846.431310] CPU: 1 PID: 1249 Comm: a.out Not tainted 4.18.0-rc3+ #1
      [  846.431312] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  846.431315] RIP: 0010:f2fs_is_valid_blkaddr+0x10f/0x160
      [  846.431316] Code: 00 eb ed 31 c0 83 fa 05 75 ae 48 83 ec 08 48 8b 3f 89 f1 48 c7 c2 fc 0b 0f 8b 48 c7 c6 8b d7 09 8b 88 44 24 07 e8 61 8b ff ff <0f> 0b 0f b6 44 24 07 48 83 c4 08 eb 81 4c 8b 47 10 8b 8f 38 04 00
      [  846.431347] RSP: 0018:ffff961c414a7bc0 EFLAGS: 00010282
      [  846.431349] RAX: 0000000000000000 RBX: ffffc5f787b8ea80 RCX: 0000000000000000
      [  846.431350] RDX: 0000000000000000 RSI: ffff89dfffd165d8 RDI: ffff89dfffd165d8
      [  846.431351] RBP: ffff961c414a7c20 R08: 0000000000000001 R09: 0000000000000248
      [  846.431353] R10: 0000000000000000 R11: 0000000000000248 R12: 0000000000000007
      [  846.431369] R13: ffff89dff5492800 R14: ffff89dfae3aa000 R15: ffff89dff4ff88d0
      [  846.431372] FS:  00007f882e2fb700(0000) GS:ffff89dfffd00000(0000) knlGS:0000000000000000
      [  846.431373] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.431374] CR2: 0000000001a88008 CR3: 00000001eb572000 CR4: 00000000000006e0
      [  846.431384] Call Trace:
      [  846.431426]  f2fs_iget+0x6f4/0xe70
      [  846.431430]  ? f2fs_find_entry+0x71/0x90
      [  846.431432]  f2fs_lookup+0x1aa/0x390
      [  846.431452]  __lookup_slow+0x97/0x150
      [  846.431459]  lookup_slow+0x35/0x50
      [  846.431462]  walk_component+0x1c6/0x470
      [  846.431479]  ? memcg_kmem_charge_memcg+0x70/0x90
      [  846.431488]  ? page_add_file_rmap+0x13/0x200
      [  846.431491]  path_lookupat+0x76/0x230
      [  846.431501]  ? __alloc_pages_nodemask+0xfc/0x280
      [  846.431504]  filename_lookup+0xb8/0x1a0
      [  846.431534]  ? _cond_resched+0x16/0x40
      [  846.431541]  ? kmem_cache_alloc+0x160/0x1d0
      [  846.431549]  ? path_listxattr+0x41/0xa0
      [  846.431551]  path_listxattr+0x41/0xa0
      [  846.431570]  do_syscall_64+0x55/0x100
      [  846.431583]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  846.431607] RIP: 0033:0x7f882de1c0d7
      [  846.431607] Code: f0 ff ff 73 01 c3 48 8b 0d be dd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 c2 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 dd 2b 00 f7 d8 64 89 01 48
      [  846.431639] RSP: 002b:00007ffe8e66c238 EFLAGS: 00000202 ORIG_RAX: 00000000000000c2
      [  846.431641] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f882de1c0d7
      [  846.431642] RDX: 0000000000000071 RSI: 00007ffe8e66c280 RDI: 0000000001a880c0
      [  846.431643] RBP: 00007ffe8e66c300 R08: 0000000001a88010 R09: 0000000000000000
      [  846.431645] R10: 00000000000001ab R11: 0000000000000202 R12: 0000000000400550
      [  846.431646] R13: 00007ffe8e66c400 R14: 0000000000000000 R15: 0000000000000000
      [  846.431648] ---[ end trace abca54df39d14f5c ]---
      [  846.431651] F2FS-fs (loop0): invalid blkaddr: 1024, type: 5, run fsck to fix.
      [  846.431762] WARNING: CPU: 1 PID: 1249 at fs/f2fs/f2fs.h:2697 f2fs_iget+0xd17/0xe70
      [  846.431763] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd input_leds joydev soundcore serio_raw i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear qxl ttm crct10dif_pclmul crc32_pclmul drm_kms_helper ghash_clmulni_intel syscopyarea sysfillrect sysimgblt fb_sys_fops pcbc drm 8139too aesni_intel 8139cp floppy psmouse mii aes_x86_64 crypto_simd pata_acpi cryptd glue_helper
      [  846.431797] CPU: 1 PID: 1249 Comm: a.out Tainted: G        W         4.18.0-rc3+ #1
      [  846.431798] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  846.431800] RIP: 0010:f2fs_iget+0xd17/0xe70
      [  846.431801] Code: ff ff 48 63 d8 e9 e1 f6 ff ff 48 8b 45 c8 41 b8 05 00 00 00 48 c7 c2 d8 e8 0e 8b 48 c7 c6 1d b0 0a 8b 48 8b 38 e8 f9 b4 00 00 <0f> 0b 48 8b 45 c8 f0 80 48 48 04 e9 d8 f9 ff ff 0f 0b 48 8b 43 18
      [  846.431832] RSP: 0018:ffff961c414a7bd0 EFLAGS: 00010282
      [  846.431834] RAX: 0000000000000000 RBX: ffffc5f787b8ea80 RCX: 0000000000000006
      [  846.431835] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff89dfffd165d0
      [  846.431836] RBP: ffff961c414a7c20 R08: 0000000000000000 R09: 0000000000000273
      [  846.431837] R10: 0000000000000000 R11: ffff89dfad50ca60 R12: 0000000000000007
      [  846.431838] R13: ffff89dff5492800 R14: ffff89dfae3aa000 R15: ffff89dff4ff88d0
      [  846.431840] FS:  00007f882e2fb700(0000) GS:ffff89dfffd00000(0000) knlGS:0000000000000000
      [  846.431841] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.431842] CR2: 0000000001a88008 CR3: 00000001eb572000 CR4: 00000000000006e0
      [  846.431846] Call Trace:
      [  846.431850]  ? f2fs_find_entry+0x71/0x90
      [  846.431853]  f2fs_lookup+0x1aa/0x390
      [  846.431856]  __lookup_slow+0x97/0x150
      [  846.431858]  lookup_slow+0x35/0x50
      [  846.431874]  walk_component+0x1c6/0x470
      [  846.431878]  ? memcg_kmem_charge_memcg+0x70/0x90
      [  846.431880]  ? page_add_file_rmap+0x13/0x200
      [  846.431882]  path_lookupat+0x76/0x230
      [  846.431884]  ? __alloc_pages_nodemask+0xfc/0x280
      [  846.431886]  filename_lookup+0xb8/0x1a0
      [  846.431890]  ? _cond_resched+0x16/0x40
      [  846.431891]  ? kmem_cache_alloc+0x160/0x1d0
      [  846.431894]  ? path_listxattr+0x41/0xa0
      [  846.431896]  path_listxattr+0x41/0xa0
      [  846.431898]  do_syscall_64+0x55/0x100
      [  846.431901]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  846.431902] RIP: 0033:0x7f882de1c0d7
      [  846.431903] Code: f0 ff ff 73 01 c3 48 8b 0d be dd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 c2 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 dd 2b 00 f7 d8 64 89 01 48
      [  846.431934] RSP: 002b:00007ffe8e66c238 EFLAGS: 00000202 ORIG_RAX: 00000000000000c2
      [  846.431936] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f882de1c0d7
      [  846.431937] RDX: 0000000000000071 RSI: 00007ffe8e66c280 RDI: 0000000001a880c0
      [  846.431939] RBP: 00007ffe8e66c300 R08: 0000000001a88010 R09: 0000000000000000
      [  846.431940] R10: 00000000000001ab R11: 0000000000000202 R12: 0000000000400550
      [  846.431941] R13: 00007ffe8e66c400 R14: 0000000000000000 R15: 0000000000000000
      [  846.431943] ---[ end trace abca54df39d14f5d ]---
      [  846.432033] F2FS-fs (loop0): access invalid blkaddr:1024
      [  846.432051] WARNING: CPU: 1 PID: 1249 at fs/f2fs/checkpoint.c:154 f2fs_is_valid_blkaddr+0x10f/0x160
      [  846.432051] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd input_leds joydev soundcore serio_raw i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear qxl ttm crct10dif_pclmul crc32_pclmul drm_kms_helper ghash_clmulni_intel syscopyarea sysfillrect sysimgblt fb_sys_fops pcbc drm 8139too aesni_intel 8139cp floppy psmouse mii aes_x86_64 crypto_simd pata_acpi cryptd glue_helper
      [  846.432085] CPU: 1 PID: 1249 Comm: a.out Tainted: G        W         4.18.0-rc3+ #1
      [  846.432086] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  846.432089] RIP: 0010:f2fs_is_valid_blkaddr+0x10f/0x160
      [  846.432089] Code: 00 eb ed 31 c0 83 fa 05 75 ae 48 83 ec 08 48 8b 3f 89 f1 48 c7 c2 fc 0b 0f 8b 48 c7 c6 8b d7 09 8b 88 44 24 07 e8 61 8b ff ff <0f> 0b 0f b6 44 24 07 48 83 c4 08 eb 81 4c 8b 47 10 8b 8f 38 04 00
      [  846.432120] RSP: 0018:ffff961c414a7900 EFLAGS: 00010286
      [  846.432122] RAX: 0000000000000000 RBX: 0000000000000400 RCX: 0000000000000006
      [  846.432123] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff89dfffd165d0
      [  846.432124] RBP: ffff89dff5492800 R08: 0000000000000001 R09: 000000000000029d
      [  846.432125] R10: ffff961c414a7820 R11: 000000000000029d R12: 0000000000000400
      [  846.432126] R13: 0000000000000000 R14: ffff89dff4ff88d0 R15: 0000000000000000
      [  846.432128] FS:  00007f882e2fb700(0000) GS:ffff89dfffd00000(0000) knlGS:0000000000000000
      [  846.432130] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.432131] CR2: 0000000001a88008 CR3: 00000001eb572000 CR4: 00000000000006e0
      [  846.432135] Call Trace:
      [  846.432151]  f2fs_wait_on_block_writeback+0x20/0x110
      [  846.432158]  f2fs_grab_read_bio+0xbc/0xe0
      [  846.432161]  f2fs_submit_page_read+0x21/0x280
      [  846.432163]  f2fs_get_read_data_page+0xb7/0x3c0
      [  846.432165]  f2fs_get_lock_data_page+0x29/0x1e0
      [  846.432167]  f2fs_get_new_data_page+0x148/0x550
      [  846.432170]  f2fs_add_regular_entry+0x1d2/0x550
      [  846.432178]  ? __switch_to+0x12f/0x460
      [  846.432181]  f2fs_add_dentry+0x6a/0xd0
      [  846.432184]  f2fs_do_add_link+0xe9/0x140
      [  846.432186]  __recover_dot_dentries+0x260/0x280
      [  846.432189]  f2fs_lookup+0x343/0x390
      [  846.432193]  __lookup_slow+0x97/0x150
      [  846.432195]  lookup_slow+0x35/0x50
      [  846.432208]  walk_component+0x1c6/0x470
      [  846.432212]  ? memcg_kmem_charge_memcg+0x70/0x90
      [  846.432215]  ? page_add_file_rmap+0x13/0x200
      [  846.432217]  path_lookupat+0x76/0x230
      [  846.432219]  ? __alloc_pages_nodemask+0xfc/0x280
      [  846.432221]  filename_lookup+0xb8/0x1a0
      [  846.432224]  ? _cond_resched+0x16/0x40
      [  846.432226]  ? kmem_cache_alloc+0x160/0x1d0
      [  846.432228]  ? path_listxattr+0x41/0xa0
      [  846.432230]  path_listxattr+0x41/0xa0
      [  846.432233]  do_syscall_64+0x55/0x100
      [  846.432235]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  846.432237] RIP: 0033:0x7f882de1c0d7
      [  846.432237] Code: f0 ff ff 73 01 c3 48 8b 0d be dd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 c2 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 dd 2b 00 f7 d8 64 89 01 48
      [  846.432269] RSP: 002b:00007ffe8e66c238 EFLAGS: 00000202 ORIG_RAX: 00000000000000c2
      [  846.432271] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f882de1c0d7
      [  846.432272] RDX: 0000000000000071 RSI: 00007ffe8e66c280 RDI: 0000000001a880c0
      [  846.432273] RBP: 00007ffe8e66c300 R08: 0000000001a88010 R09: 0000000000000000
      [  846.432274] R10: 00000000000001ab R11: 0000000000000202 R12: 0000000000400550
      [  846.432275] R13: 00007ffe8e66c400 R14: 0000000000000000 R15: 0000000000000000
      [  846.432277] ---[ end trace abca54df39d14f5e ]---
      [  846.432279] F2FS-fs (loop0): invalid blkaddr: 1024, type: 5, run fsck to fix.
      [  846.432376] WARNING: CPU: 1 PID: 1249 at fs/f2fs/f2fs.h:2697 f2fs_wait_on_block_writeback+0xb1/0x110
      [  846.432376] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd input_leds joydev soundcore serio_raw i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear qxl ttm crct10dif_pclmul crc32_pclmul drm_kms_helper ghash_clmulni_intel syscopyarea sysfillrect sysimgblt fb_sys_fops pcbc drm 8139too aesni_intel 8139cp floppy psmouse mii aes_x86_64 crypto_simd pata_acpi cryptd glue_helper
      [  846.432410] CPU: 1 PID: 1249 Comm: a.out Tainted: G        W         4.18.0-rc3+ #1
      [  846.432411] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  846.432413] RIP: 0010:f2fs_wait_on_block_writeback+0xb1/0x110
      [  846.432414] Code: 66 90 f0 ff 4b 34 74 59 5b 5d c3 48 8b 7d 00 41 b8 05 00 00 00 89 d9 48 c7 c2 d8 e8 0e 8b 48 c7 c6 1d b0 0a 8b e8 df bc fd ff <0f> 0b f0 80 4d 48 04 e9 67 ff ff ff 48 8b 03 48 c1 e8 37 83 e0 07
      [  846.432445] RSP: 0018:ffff961c414a7910 EFLAGS: 00010286
      [  846.432447] RAX: 0000000000000000 RBX: 0000000000000400 RCX: 0000000000000006
      [  846.432448] RDX: 0000000000000000 RSI: 0000000000000092 RDI: ffff89dfffd165d0
      [  846.432449] RBP: ffff89dff5492800 R08: 0000000000000000 R09: 00000000000002d1
      [  846.432450] R10: ffff961c414a7820 R11: ffff89dfad50cf80 R12: 0000000000000400
      [  846.432451] R13: 0000000000000000 R14: ffff89dff4ff88d0 R15: 0000000000000000
      [  846.432453] FS:  00007f882e2fb700(0000) GS:ffff89dfffd00000(0000) knlGS:0000000000000000
      [  846.432454] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.432455] CR2: 0000000001a88008 CR3: 00000001eb572000 CR4: 00000000000006e0
      [  846.432459] Call Trace:
      [  846.432463]  f2fs_grab_read_bio+0xbc/0xe0
      [  846.432464]  f2fs_submit_page_read+0x21/0x280
      [  846.432466]  f2fs_get_read_data_page+0xb7/0x3c0
      [  846.432468]  f2fs_get_lock_data_page+0x29/0x1e0
      [  846.432470]  f2fs_get_new_data_page+0x148/0x550
      [  846.432473]  f2fs_add_regular_entry+0x1d2/0x550
      [  846.432475]  ? __switch_to+0x12f/0x460
      [  846.432477]  f2fs_add_dentry+0x6a/0xd0
      [  846.432480]  f2fs_do_add_link+0xe9/0x140
      [  846.432483]  __recover_dot_dentries+0x260/0x280
      [  846.432485]  f2fs_lookup+0x343/0x390
      [  846.432488]  __lookup_slow+0x97/0x150
      [  846.432490]  lookup_slow+0x35/0x50
      [  846.432505]  walk_component+0x1c6/0x470
      [  846.432509]  ? memcg_kmem_charge_memcg+0x70/0x90
      [  846.432511]  ? page_add_file_rmap+0x13/0x200
      [  846.432513]  path_lookupat+0x76/0x230
      [  846.432515]  ? __alloc_pages_nodemask+0xfc/0x280
      [  846.432517]  filename_lookup+0xb8/0x1a0
      [  846.432520]  ? _cond_resched+0x16/0x40
      [  846.432522]  ? kmem_cache_alloc+0x160/0x1d0
      [  846.432525]  ? path_listxattr+0x41/0xa0
      [  846.432526]  path_listxattr+0x41/0xa0
      [  846.432529]  do_syscall_64+0x55/0x100
      [  846.432531]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  846.432533] RIP: 0033:0x7f882de1c0d7
      [  846.432533] Code: f0 ff ff 73 01 c3 48 8b 0d be dd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 c2 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 dd 2b 00 f7 d8 64 89 01 48
      [  846.432565] RSP: 002b:00007ffe8e66c238 EFLAGS: 00000202 ORIG_RAX: 00000000000000c2
      [  846.432567] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f882de1c0d7
      [  846.432568] RDX: 0000000000000071 RSI: 00007ffe8e66c280 RDI: 0000000001a880c0
      [  846.432569] RBP: 00007ffe8e66c300 R08: 0000000001a88010 R09: 0000000000000000
      [  846.432570] R10: 00000000000001ab R11: 0000000000000202 R12: 0000000000400550
      [  846.432571] R13: 00007ffe8e66c400 R14: 0000000000000000 R15: 0000000000000000
      [  846.432573] ---[ end trace abca54df39d14f5f ]---
      [  846.434280] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
      [  846.434424] PGD 80000001ebd3a067 P4D 80000001ebd3a067 PUD 1eb1ae067 PMD 0
      [  846.434551] Oops: 0000 [#1] SMP PTI
      [  846.434697] CPU: 0 PID: 44 Comm: kworker/u5:0 Tainted: G        W         4.18.0-rc3+ #1
      [  846.434805] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  846.435000] Workqueue: fscrypt_read_queue decrypt_work
      [  846.435174] RIP: 0010:fscrypt_do_page_crypto+0x6e/0x2d0
      [  846.435351] Code: 00 65 48 8b 04 25 28 00 00 00 48 89 84 24 88 00 00 00 31 c0 e8 43 c2 e0 ff 49 8b 86 48 02 00 00 85 ed c7 44 24 70 00 00 00 00 <48> 8b 58 08 0f 84 14 02 00 00 48 8b 78 10 48 8b 0c 24 48 c7 84 24
      [  846.435696] RSP: 0018:ffff961c40f9bd60 EFLAGS: 00010206
      [  846.435870] RAX: 0000000000000000 RBX: ffffc5f787719b80 RCX: ffffc5f787719b80
      [  846.436051] RDX: ffffffff8b9f4b88 RSI: ffffffff8b0ae622 RDI: ffff961c40f9bdb8
      [  846.436261] RBP: 0000000000001000 R08: ffffc5f787719b80 R09: 0000000000001000
      [  846.436433] R10: 0000000000000018 R11: fefefefefefefeff R12: ffffc5f787719b80
      [  846.436562] R13: ffffc5f787719b80 R14: ffff89dff4ff88d0 R15: 0ffff89dfaddee60
      [  846.436658] FS:  0000000000000000(0000) GS:ffff89dfffc00000(0000) knlGS:0000000000000000
      [  846.436758] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.436898] CR2: 0000000000000008 CR3: 00000001eddd0000 CR4: 00000000000006f0
      [  846.437001] Call Trace:
      [  846.437181]  ? check_preempt_wakeup+0xf2/0x230
      [  846.437276]  ? check_preempt_curr+0x7c/0x90
      [  846.437370]  fscrypt_decrypt_page+0x48/0x4d
      [  846.437466]  __fscrypt_decrypt_bio+0x5b/0x90
      [  846.437542]  decrypt_work+0x12/0x20
      [  846.437651]  process_one_work+0x15e/0x3d0
      [  846.437740]  worker_thread+0x4c/0x440
      [  846.437848]  kthread+0xf8/0x130
      [  846.437938]  ? rescuer_thread+0x350/0x350
      [  846.438022]  ? kthread_associate_blkcg+0x90/0x90
      [  846.438117]  ret_from_fork+0x35/0x40
      [  846.438201] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd input_leds joydev soundcore serio_raw i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear qxl ttm crct10dif_pclmul crc32_pclmul drm_kms_helper ghash_clmulni_intel syscopyarea sysfillrect sysimgblt fb_sys_fops pcbc drm 8139too aesni_intel 8139cp floppy psmouse mii aes_x86_64 crypto_simd pata_acpi cryptd glue_helper
      [  846.438653] CR2: 0000000000000008
      [  846.438713] ---[ end trace abca54df39d14f60 ]---
      [  846.438796] RIP: 0010:fscrypt_do_page_crypto+0x6e/0x2d0
      [  846.438844] Code: 00 65 48 8b 04 25 28 00 00 00 48 89 84 24 88 00 00 00 31 c0 e8 43 c2 e0 ff 49 8b 86 48 02 00 00 85 ed c7 44 24 70 00 00 00 00 <48> 8b 58 08 0f 84 14 02 00 00 48 8b 78 10 48 8b 0c 24 48 c7 84 24
      [  846.439084] RSP: 0018:ffff961c40f9bd60 EFLAGS: 00010206
      [  846.439176] RAX: 0000000000000000 RBX: ffffc5f787719b80 RCX: ffffc5f787719b80
      [  846.440927] RDX: ffffffff8b9f4b88 RSI: ffffffff8b0ae622 RDI: ffff961c40f9bdb8
      [  846.442083] RBP: 0000000000001000 R08: ffffc5f787719b80 R09: 0000000000001000
      [  846.443284] R10: 0000000000000018 R11: fefefefefefefeff R12: ffffc5f787719b80
      [  846.444448] R13: ffffc5f787719b80 R14: ffff89dff4ff88d0 R15: 0ffff89dfaddee60
      [  846.445558] FS:  0000000000000000(0000) GS:ffff89dfffc00000(0000) knlGS:0000000000000000
      [  846.446687] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  846.447796] CR2: 0000000000000008 CR3: 00000001eddd0000 CR4: 00000000000006f0
      
      - Location
      https://elixir.bootlin.com/linux/v4.18-rc4/source/fs/crypto/crypto.c#L149
      	struct crypto_skcipher *tfm = ci->ci_ctfm;
      Here ci can be NULL
      
      Note that this issue maybe require CONFIG_F2FS_FS_ENCRYPTION=y to reproduce.
      
      Reported-by Wen Xu <wen.xu@gatech.edu>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b10a6ac2
    • Jaegeuk Kim's avatar
      f2fs: fix missing up_read · e33c1e29
      Jaegeuk Kim authored
      commit 89d13c38501df730cbb2e02c4499da1b5187119d upstream.
      
      This patch fixes missing up_read call.
      
      Fixes: c9b60788fc76 ("f2fs: fix to do sanity check with block address in main area")
      Reviewed-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e33c1e29
    • Chao Yu's avatar
      f2fs: fix to do sanity check with block address in main area · aafb3715
      Chao Yu authored
      commit c9b60788fc760d136211853f10ce73dc152d1f4a upstream.
      
      This patch add to do sanity check with below field:
      - cp_pack_total_block_count
      - blkaddr of data/node
      - extent info
      
      - Overview
      BUG() in verify_block_addr() when writing to a corrupted f2fs image
      
      - Reproduce (4.18 upstream kernel)
      
      - POC (poc.c)
      
      static void activity(char *mpoint) {
      
        char *foo_bar_baz;
        int err;
      
        static int buf[8192];
        memset(buf, 0, sizeof(buf));
      
        err = asprintf(&foo_bar_baz, "%s/foo/bar/baz", mpoint);
      
        int fd = open(foo_bar_baz, O_RDWR | O_TRUNC, 0777);
        if (fd >= 0) {
          write(fd, (char *)buf, sizeof(buf));
          fdatasync(fd);
          close(fd);
        }
      }
      
      int main(int argc, char *argv[]) {
        activity(argv[1]);
        return 0;
      }
      
      - Kernel message
      [  689.349473] F2FS-fs (loop0): Mounted with checkpoint version = 3
      [  699.728662] WARNING: CPU: 0 PID: 1309 at fs/f2fs/segment.c:2860 f2fs_inplace_write_data+0x232/0x240
      [  699.728670] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too crct10dif_pclmul crc32_pclmul qxl drm_kms_helper syscopyarea aesni_intel sysfillrect sysimgblt fb_sys_fops ttm drm aes_x86_64 crypto_simd cryptd 8139cp glue_helper mii pata_acpi floppy
      [  699.729056] CPU: 0 PID: 1309 Comm: a.out Not tainted 4.18.0-rc1+ #4
      [  699.729064] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  699.729074] RIP: 0010:f2fs_inplace_write_data+0x232/0x240
      [  699.729076] Code: ff e9 cf fe ff ff 49 8d 7d 10 e8 39 45 ad ff 4d 8b 7d 10 be 04 00 00 00 49 8d 7f 48 e8 07 49 ad ff 45 8b 7f 48 e9 fb fe ff ff <0f> 0b f0 41 80 4d 48 04 e9 65 fe ff ff 90 66 66 66 66 90 55 48 8d
      [  699.729130] RSP: 0018:ffff8801f43af568 EFLAGS: 00010202
      [  699.729139] RAX: 000000000000003f RBX: ffff8801f43af7b8 RCX: ffffffffb88c9113
      [  699.729142] RDX: 0000000000000003 RSI: dffffc0000000000 RDI: ffff8802024e5540
      [  699.729144] RBP: ffff8801f43af590 R08: 0000000000000009 R09: ffffffffffffffe8
      [  699.729147] R10: 0000000000000001 R11: ffffed0039b0596a R12: ffff8802024e5540
      [  699.729149] R13: ffff8801f0335500 R14: ffff8801e3e7a700 R15: ffff8801e1ee4450
      [  699.729154] FS:  00007f9bf97f5700(0000) GS:ffff8801f6e00000(0000) knlGS:0000000000000000
      [  699.729156] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  699.729159] CR2: 00007f9bf925d170 CR3: 00000001f0c34000 CR4: 00000000000006f0
      [  699.729171] Call Trace:
      [  699.729192]  f2fs_do_write_data_page+0x2e2/0xe00
      [  699.729203]  ? f2fs_should_update_outplace+0xd0/0xd0
      [  699.729238]  ? memcg_drain_all_list_lrus+0x280/0x280
      [  699.729269]  ? __radix_tree_replace+0xa3/0x120
      [  699.729276]  __write_data_page+0x5c7/0xe30
      [  699.729291]  ? kasan_check_read+0x11/0x20
      [  699.729310]  ? page_mapped+0x8a/0x110
      [  699.729321]  ? page_mkclean+0xe9/0x160
      [  699.729327]  ? f2fs_do_write_data_page+0xe00/0xe00
      [  699.729331]  ? invalid_page_referenced_vma+0x130/0x130
      [  699.729345]  ? clear_page_dirty_for_io+0x332/0x450
      [  699.729351]  f2fs_write_cache_pages+0x4ca/0x860
      [  699.729358]  ? __write_data_page+0xe30/0xe30
      [  699.729374]  ? percpu_counter_add_batch+0x22/0xa0
      [  699.729380]  ? kasan_check_write+0x14/0x20
      [  699.729391]  ? _raw_spin_lock+0x17/0x40
      [  699.729403]  ? f2fs_mark_inode_dirty_sync.part.18+0x16/0x30
      [  699.729413]  ? iov_iter_advance+0x113/0x640
      [  699.729418]  ? f2fs_write_end+0x133/0x2e0
      [  699.729423]  ? balance_dirty_pages_ratelimited+0x239/0x640
      [  699.729428]  f2fs_write_data_pages+0x329/0x520
      [  699.729433]  ? generic_perform_write+0x250/0x320
      [  699.729438]  ? f2fs_write_cache_pages+0x860/0x860
      [  699.729454]  ? current_time+0x110/0x110
      [  699.729459]  ? f2fs_preallocate_blocks+0x1ef/0x370
      [  699.729464]  do_writepages+0x37/0xb0
      [  699.729468]  ? f2fs_write_cache_pages+0x860/0x860
      [  699.729472]  ? do_writepages+0x37/0xb0
      [  699.729478]  __filemap_fdatawrite_range+0x19a/0x1f0
      [  699.729483]  ? delete_from_page_cache_batch+0x4e0/0x4e0
      [  699.729496]  ? __vfs_write+0x2b2/0x410
      [  699.729501]  file_write_and_wait_range+0x66/0xb0
      [  699.729506]  f2fs_do_sync_file+0x1f9/0xd90
      [  699.729511]  ? truncate_partial_data_page+0x290/0x290
      [  699.729521]  ? __sb_end_write+0x30/0x50
      [  699.729526]  ? vfs_write+0x20f/0x260
      [  699.729530]  f2fs_sync_file+0x9a/0xb0
      [  699.729534]  ? f2fs_do_sync_file+0xd90/0xd90
      [  699.729548]  vfs_fsync_range+0x68/0x100
      [  699.729554]  ? __fget_light+0xc9/0xe0
      [  699.729558]  do_fsync+0x3d/0x70
      [  699.729562]  __x64_sys_fdatasync+0x24/0x30
      [  699.729585]  do_syscall_64+0x78/0x170
      [  699.729595]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  699.729613] RIP: 0033:0x7f9bf930d800
      [  699.729615] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 49 bf 2c 00 00 75 10 b8 4b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 be 78 01 00 48 89 04 24
      [  699.729668] RSP: 002b:00007ffee3606c68 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
      [  699.729673] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9bf930d800
      [  699.729675] RDX: 0000000000008000 RSI: 00000000006010a0 RDI: 0000000000000003
      [  699.729678] RBP: 00007ffee3606ca0 R08: 0000000001503010 R09: 0000000000000000
      [  699.729680] R10: 00000000000002e8 R11: 0000000000000246 R12: 0000000000400610
      [  699.729683] R13: 00007ffee3606da0 R14: 0000000000000000 R15: 0000000000000000
      [  699.729687] ---[ end trace 4ce02f25ff7d3df5 ]---
      [  699.729782] ------------[ cut here ]------------
      [  699.729785] kernel BUG at fs/f2fs/segment.h:654!
      [  699.731055] invalid opcode: 0000 [#1] SMP KASAN PTI
      [  699.732104] CPU: 0 PID: 1309 Comm: a.out Tainted: G        W         4.18.0-rc1+ #4
      [  699.733684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  699.735611] RIP: 0010:f2fs_submit_page_bio+0x29b/0x730
      [  699.736649] Code: 54 49 8d bd 18 04 00 00 e8 b2 59 af ff 41 8b 8d 18 04 00 00 8b 45 b8 41 d3 e6 44 01 f0 4c 8d 73 14 41 39 c7 0f 82 37 fe ff ff <0f> 0b 65 8b 05 2c 04 77 47 89 c0 48 0f a3 05 52 c1 d5 01 0f 92 c0
      [  699.740524] RSP: 0018:ffff8801f43af508 EFLAGS: 00010283
      [  699.741573] RAX: 0000000000000000 RBX: ffff8801f43af7b8 RCX: ffffffffb88a7cef
      [  699.743006] RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff8801e3e7a64c
      [  699.744426] RBP: ffff8801f43af558 R08: ffffed003e066b55 R09: ffffed003e066b55
      [  699.745833] R10: 0000000000000001 R11: ffffed003e066b54 R12: ffffea0007876940
      [  699.747256] R13: ffff8801f0335500 R14: ffff8801e3e7a600 R15: 0000000000000001
      [  699.748683] FS:  00007f9bf97f5700(0000) GS:ffff8801f6e00000(0000) knlGS:0000000000000000
      [  699.750293] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  699.751462] CR2: 00007f9bf925d170 CR3: 00000001f0c34000 CR4: 00000000000006f0
      [  699.752874] Call Trace:
      [  699.753386]  ? f2fs_inplace_write_data+0x93/0x240
      [  699.754341]  f2fs_inplace_write_data+0xd2/0x240
      [  699.755271]  f2fs_do_write_data_page+0x2e2/0xe00
      [  699.756214]  ? f2fs_should_update_outplace+0xd0/0xd0
      [  699.757215]  ? memcg_drain_all_list_lrus+0x280/0x280
      [  699.758209]  ? __radix_tree_replace+0xa3/0x120
      [  699.759164]  __write_data_page+0x5c7/0xe30
      [  699.760002]  ? kasan_check_read+0x11/0x20
      [  699.760823]  ? page_mapped+0x8a/0x110
      [  699.761573]  ? page_mkclean+0xe9/0x160
      [  699.762345]  ? f2fs_do_write_data_page+0xe00/0xe00
      [  699.763332]  ? invalid_page_referenced_vma+0x130/0x130
      [  699.764374]  ? clear_page_dirty_for_io+0x332/0x450
      [  699.765347]  f2fs_write_cache_pages+0x4ca/0x860
      [  699.766276]  ? __write_data_page+0xe30/0xe30
      [  699.767161]  ? percpu_counter_add_batch+0x22/0xa0
      [  699.768112]  ? kasan_check_write+0x14/0x20
      [  699.768951]  ? _raw_spin_lock+0x17/0x40
      [  699.769739]  ? f2fs_mark_inode_dirty_sync.part.18+0x16/0x30
      [  699.770885]  ? iov_iter_advance+0x113/0x640
      [  699.771743]  ? f2fs_write_end+0x133/0x2e0
      [  699.772569]  ? balance_dirty_pages_ratelimited+0x239/0x640
      [  699.773680]  f2fs_write_data_pages+0x329/0x520
      [  699.774603]  ? generic_perform_write+0x250/0x320
      [  699.775544]  ? f2fs_write_cache_pages+0x860/0x860
      [  699.776510]  ? current_time+0x110/0x110
      [  699.777299]  ? f2fs_preallocate_blocks+0x1ef/0x370
      [  699.778279]  do_writepages+0x37/0xb0
      [  699.779026]  ? f2fs_write_cache_pages+0x860/0x860
      [  699.779978]  ? do_writepages+0x37/0xb0
      [  699.780755]  __filemap_fdatawrite_range+0x19a/0x1f0
      [  699.781746]  ? delete_from_page_cache_batch+0x4e0/0x4e0
      [  699.782820]  ? __vfs_write+0x2b2/0x410
      [  699.783597]  file_write_and_wait_range+0x66/0xb0
      [  699.784540]  f2fs_do_sync_file+0x1f9/0xd90
      [  699.785381]  ? truncate_partial_data_page+0x290/0x290
      [  699.786415]  ? __sb_end_write+0x30/0x50
      [  699.787204]  ? vfs_write+0x20f/0x260
      [  699.787941]  f2fs_sync_file+0x9a/0xb0
      [  699.788694]  ? f2fs_do_sync_file+0xd90/0xd90
      [  699.789572]  vfs_fsync_range+0x68/0x100
      [  699.790360]  ? __fget_light+0xc9/0xe0
      [  699.791128]  do_fsync+0x3d/0x70
      [  699.791779]  __x64_sys_fdatasync+0x24/0x30
      [  699.792614]  do_syscall_64+0x78/0x170
      [  699.793371]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  699.794406] RIP: 0033:0x7f9bf930d800
      [  699.795134] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 49 bf 2c 00 00 75 10 b8 4b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 be 78 01 00 48 89 04 24
      [  699.798960] RSP: 002b:00007ffee3606c68 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
      [  699.800483] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9bf930d800
      [  699.801923] RDX: 0000000000008000 RSI: 00000000006010a0 RDI: 0000000000000003
      [  699.803373] RBP: 00007ffee3606ca0 R08: 0000000001503010 R09: 0000000000000000
      [  699.804798] R10: 00000000000002e8 R11: 0000000000000246 R12: 0000000000400610
      [  699.806233] R13: 00007ffee3606da0 R14: 0000000000000000 R15: 0000000000000000
      [  699.807667] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too crct10dif_pclmul crc32_pclmul qxl drm_kms_helper syscopyarea aesni_intel sysfillrect sysimgblt fb_sys_fops ttm drm aes_x86_64 crypto_simd cryptd 8139cp glue_helper mii pata_acpi floppy
      [  699.817079] ---[ end trace 4ce02f25ff7d3df6 ]---
      [  699.818068] RIP: 0010:f2fs_submit_page_bio+0x29b/0x730
      [  699.819114] Code: 54 49 8d bd 18 04 00 00 e8 b2 59 af ff 41 8b 8d 18 04 00 00 8b 45 b8 41 d3 e6 44 01 f0 4c 8d 73 14 41 39 c7 0f 82 37 fe ff ff <0f> 0b 65 8b 05 2c 04 77 47 89 c0 48 0f a3 05 52 c1 d5 01 0f 92 c0
      [  699.822919] RSP: 0018:ffff8801f43af508 EFLAGS: 00010283
      [  699.823977] RAX: 0000000000000000 RBX: ffff8801f43af7b8 RCX: ffffffffb88a7cef
      [  699.825436] RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff8801e3e7a64c
      [  699.826881] RBP: ffff8801f43af558 R08: ffffed003e066b55 R09: ffffed003e066b55
      [  699.828292] R10: 0000000000000001 R11: ffffed003e066b54 R12: ffffea0007876940
      [  699.829750] R13: ffff8801f0335500 R14: ffff8801e3e7a600 R15: 0000000000000001
      [  699.831192] FS:  00007f9bf97f5700(0000) GS:ffff8801f6e00000(0000) knlGS:0000000000000000
      [  699.832793] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  699.833981] CR2: 00007f9bf925d170 CR3: 00000001f0c34000 CR4: 00000000000006f0
      [  699.835556] ==================================================================
      [  699.837029] BUG: KASAN: stack-out-of-bounds in update_stack_state+0x38c/0x3e0
      [  699.838462] Read of size 8 at addr ffff8801f43af970 by task a.out/1309
      
      [  699.840086] CPU: 0 PID: 1309 Comm: a.out Tainted: G      D W         4.18.0-rc1+ #4
      [  699.841603] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  699.843475] Call Trace:
      [  699.843982]  dump_stack+0x7b/0xb5
      [  699.844661]  print_address_description+0x70/0x290
      [  699.845607]  kasan_report+0x291/0x390
      [  699.846351]  ? update_stack_state+0x38c/0x3e0
      [  699.853831]  __asan_load8+0x54/0x90
      [  699.854569]  update_stack_state+0x38c/0x3e0
      [  699.855428]  ? __read_once_size_nocheck.constprop.7+0x20/0x20
      [  699.856601]  ? __save_stack_trace+0x5e/0x100
      [  699.857476]  unwind_next_frame.part.5+0x18e/0x490
      [  699.858448]  ? unwind_dump+0x290/0x290
      [  699.859217]  ? clear_page_dirty_for_io+0x332/0x450
      [  699.860185]  __unwind_start+0x106/0x190
      [  699.860974]  __save_stack_trace+0x5e/0x100
      [  699.861808]  ? __save_stack_trace+0x5e/0x100
      [  699.862691]  ? unlink_anon_vmas+0xba/0x2c0
      [  699.863525]  save_stack_trace+0x1f/0x30
      [  699.864312]  save_stack+0x46/0xd0
      [  699.864993]  ? __alloc_pages_slowpath+0x1420/0x1420
      [  699.865990]  ? flush_tlb_mm_range+0x15e/0x220
      [  699.866889]  ? kasan_check_write+0x14/0x20
      [  699.867724]  ? __dec_node_state+0x92/0xb0
      [  699.868543]  ? lock_page_memcg+0x85/0xf0
      [  699.869350]  ? unlock_page_memcg+0x16/0x80
      [  699.870185]  ? page_remove_rmap+0x198/0x520
      [  699.871048]  ? mark_page_accessed+0x133/0x200
      [  699.871930]  ? _cond_resched+0x1a/0x50
      [  699.872700]  ? unmap_page_range+0xcd4/0xe50
      [  699.873551]  ? rb_next+0x58/0x80
      [  699.874217]  ? rb_next+0x58/0x80
      [  699.874895]  __kasan_slab_free+0x13c/0x1a0
      [  699.875734]  ? unlink_anon_vmas+0xba/0x2c0
      [  699.876563]  kasan_slab_free+0xe/0x10
      [  699.877315]  kmem_cache_free+0x89/0x1e0
      [  699.878095]  unlink_anon_vmas+0xba/0x2c0
      [  699.878913]  free_pgtables+0x101/0x1b0
      [  699.879677]  exit_mmap+0x146/0x2a0
      [  699.880378]  ? __ia32_sys_munmap+0x50/0x50
      [  699.881214]  ? kasan_check_read+0x11/0x20
      [  699.882052]  ? mm_update_next_owner+0x322/0x380
      [  699.882985]  mmput+0x8b/0x1d0
      [  699.883602]  do_exit+0x43a/0x1390
      [  699.884288]  ? mm_update_next_owner+0x380/0x380
      [  699.885212]  ? f2fs_sync_file+0x9a/0xb0
      [  699.885995]  ? f2fs_do_sync_file+0xd90/0xd90
      [  699.886877]  ? vfs_fsync_range+0x68/0x100
      [  699.887694]  ? __fget_light+0xc9/0xe0
      [  699.888442]  ? do_fsync+0x3d/0x70
      [  699.889118]  ? __x64_sys_fdatasync+0x24/0x30
      [  699.889996]  rewind_stack_do_exit+0x17/0x20
      [  699.890860] RIP: 0033:0x7f9bf930d800
      [  699.891585] Code: Bad RIP value.
      [  699.892268] RSP: 002b:00007ffee3606c68 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
      [  699.893781] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9bf930d800
      [  699.895220] RDX: 0000000000008000 RSI: 00000000006010a0 RDI: 0000000000000003
      [  699.896643] RBP: 00007ffee3606ca0 R08: 0000000001503010 R09: 0000000000000000
      [  699.898069] R10: 00000000000002e8 R11: 0000000000000246 R12: 0000000000400610
      [  699.899505] R13: 00007ffee3606da0 R14: 0000000000000000 R15: 0000000000000000
      
      [  699.901241] The buggy address belongs to the page:
      [  699.902215] page:ffffea0007d0ebc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      [  699.903811] flags: 0x2ffff0000000000()
      [  699.904585] raw: 02ffff0000000000 0000000000000000 ffffffff07d00101 0000000000000000
      [  699.906125] raw: 0000000000000000 0000000000240000 00000000ffffffff 0000000000000000
      [  699.907673] page dumped because: kasan: bad access detected
      
      [  699.909108] Memory state around the buggy address:
      [  699.910077]  ffff8801f43af800: 00 f1 f1 f1 f1 00 f4 f4 f4 f3 f3 f3 f3 00 00 00
      [  699.911528]  ffff8801f43af880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  699.912953] >ffff8801f43af900: 00 00 00 00 00 00 00 00 f1 01 f4 f4 f4 f2 f2 f2
      [  699.914392]                                                              ^
      [  699.915758]  ffff8801f43af980: f2 00 f4 f4 00 00 00 00 f2 00 00 00 00 00 00 00
      [  699.917193]  ffff8801f43afa00: 00 00 00 00 00 00 00 00 00 f3 f3 f3 00 00 00 00
      [  699.918634] ==================================================================
      
      - Location
      https://elixir.bootlin.com/linux/v4.18-rc1/source/fs/f2fs/segment.h#L644
      
      Reported-by Wen Xu <wen.xu@gatech.edu>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9:
       - Error label is different in validate_checkpoint() due to the earlier
         backport of "f2fs: fix invalid memory access"
       - Adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      aafb3715
    • Chao Yu's avatar
      f2fs: fix to do sanity check with node footer and iblocks · 1c879805
      Chao Yu authored
      commit e34438c903b653daca2b2a7de95aed46226f8ed3 upstream.
      
      This patch adds to do sanity check with below fields of inode to
      avoid reported panic.
      - node footer
      - iblocks
      
      https://bugzilla.kernel.org/show_bug.cgi?id=200223
      
      - Overview
      BUG() triggered in f2fs_truncate_inode_blocks() when un-mounting a mounted f2fs image after writing to it
      
      - Reproduce
      
      - POC (poc.c)
      
      static void activity(char *mpoint) {
      
        char *foo_bar_baz;
        int err;
      
        static int buf[8192];
        memset(buf, 0, sizeof(buf));
      
        err = asprintf(&foo_bar_baz, "%s/foo/bar/baz", mpoint);
      
        // open / write / read
        int fd = open(foo_bar_baz, O_RDWR | O_TRUNC, 0777);
        if (fd >= 0) {
          write(fd, (char *)buf, 517);
          write(fd, (char *)buf, sizeof(buf));
          close(fd);
        }
      
      }
      
      int main(int argc, char *argv[]) {
        activity(argv[1]);
        return 0;
      }
      
      - Kernel meesage
      [  552.479723] F2FS-fs (loop0): Mounted with checkpoint version = 2
      [  556.451891] ------------[ cut here ]------------
      [  556.451899] kernel BUG at fs/f2fs/node.c:987!
      [  556.452920] invalid opcode: 0000 [#1] SMP KASAN PTI
      [  556.453936] CPU: 1 PID: 1310 Comm: umount Not tainted 4.18.0-rc1+ #4
      [  556.455213] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  556.457140] RIP: 0010:f2fs_truncate_inode_blocks+0x4a7/0x6f0
      [  556.458280] Code: e8 ae ea ff ff 41 89 c7 c1 e8 1f 84 c0 74 0a 41 83 ff fe 0f 85 35 ff ff ff 81 85 b0 fe ff ff fb 03 00 00 e9 f7 fd ff ff 0f 0b <0f> 0b e8 62 b7 9a 00 48 8b bd a0 fe ff ff e8 56 54 ae ff 48 8b b5
      [  556.462015] RSP: 0018:ffff8801f292f808 EFLAGS: 00010286
      [  556.463068] RAX: ffffed003e73242d RBX: ffff8801f292f958 RCX: ffffffffb88b81bc
      [  556.464479] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801f3992164
      [  556.465901] RBP: ffff8801f292f980 R08: ffffed003e73242d R09: ffffed003e73242d
      [  556.467311] R10: 0000000000000001 R11: ffffed003e73242c R12: 00000000fffffc64
      [  556.468706] R13: ffff8801f3992000 R14: 0000000000000058 R15: 00000000ffff8801
      [  556.470117] FS:  00007f8029297840(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
      [  556.471702] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  556.472838] CR2: 000055f5f57305d8 CR3: 00000001f18b0000 CR4: 00000000000006e0
      [  556.474265] Call Trace:
      [  556.474782]  ? f2fs_alloc_nid_failed+0xf0/0xf0
      [  556.475686]  ? truncate_nodes+0x980/0x980
      [  556.476516]  ? pagecache_get_page+0x21f/0x2f0
      [  556.477412]  ? __asan_loadN+0xf/0x20
      [  556.478153]  ? __get_node_page+0x331/0x5b0
      [  556.478992]  ? reweight_entity+0x1e6/0x3b0
      [  556.479826]  f2fs_truncate_blocks+0x55e/0x740
      [  556.480709]  ? f2fs_truncate_data_blocks+0x20/0x20
      [  556.481689]  ? __radix_tree_lookup+0x34/0x160
      [  556.482630]  ? radix_tree_lookup+0xd/0x10
      [  556.483445]  f2fs_truncate+0xd4/0x1a0
      [  556.484206]  f2fs_evict_inode+0x5ce/0x630
      [  556.485032]  evict+0x16f/0x290
      [  556.485664]  iput+0x280/0x300
      [  556.486300]  dentry_unlink_inode+0x165/0x1e0
      [  556.487169]  __dentry_kill+0x16a/0x260
      [  556.487936]  dentry_kill+0x70/0x250
      [  556.488651]  shrink_dentry_list+0x125/0x260
      [  556.489504]  shrink_dcache_parent+0xc1/0x110
      [  556.490379]  ? shrink_dcache_sb+0x200/0x200
      [  556.491231]  ? bit_wait_timeout+0xc0/0xc0
      [  556.492047]  do_one_tree+0x12/0x40
      [  556.492743]  shrink_dcache_for_umount+0x3f/0xa0
      [  556.493656]  generic_shutdown_super+0x43/0x1c0
      [  556.494561]  kill_block_super+0x52/0x80
      [  556.495341]  kill_f2fs_super+0x62/0x70
      [  556.496105]  deactivate_locked_super+0x6f/0xa0
      [  556.497004]  deactivate_super+0x5e/0x80
      [  556.497785]  cleanup_mnt+0x61/0xa0
      [  556.498492]  __cleanup_mnt+0x12/0x20
      [  556.499218]  task_work_run+0xc8/0xf0
      [  556.499949]  exit_to_usermode_loop+0x125/0x130
      [  556.500846]  do_syscall_64+0x138/0x170
      [  556.501609]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  556.502659] RIP: 0033:0x7f8028b77487
      [  556.503384] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 c9 2b 00 f7 d8 64 89 01 48
      [  556.507137] RSP: 002b:00007fff9f2e3598 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
      [  556.508637] RAX: 0000000000000000 RBX: 0000000000ebd030 RCX: 00007f8028b77487
      [  556.510069] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000ec41e0
      [  556.511481] RBP: 0000000000ec41e0 R08: 0000000000000000 R09: 0000000000000014
      [  556.512892] R10: 00000000000006b2 R11: 0000000000000246 R12: 00007f802908083c
      [  556.514320] R13: 0000000000000000 R14: 0000000000ebd210 R15: 00007fff9f2e3820
      [  556.515745] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too crct10dif_pclmul crc32_pclmul qxl drm_kms_helper syscopyarea aesni_intel sysfillrect sysimgblt fb_sys_fops ttm drm aes_x86_64 crypto_simd cryptd 8139cp glue_helper mii pata_acpi floppy
      [  556.529276] ---[ end trace 4ce02f25ff7d3df5 ]---
      [  556.530340] RIP: 0010:f2fs_truncate_inode_blocks+0x4a7/0x6f0
      [  556.531513] Code: e8 ae ea ff ff 41 89 c7 c1 e8 1f 84 c0 74 0a 41 83 ff fe 0f 85 35 ff ff ff 81 85 b0 fe ff ff fb 03 00 00 e9 f7 fd ff ff 0f 0b <0f> 0b e8 62 b7 9a 00 48 8b bd a0 fe ff ff e8 56 54 ae ff 48 8b b5
      [  556.535330] RSP: 0018:ffff8801f292f808 EFLAGS: 00010286
      [  556.536395] RAX: ffffed003e73242d RBX: ffff8801f292f958 RCX: ffffffffb88b81bc
      [  556.537824] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801f3992164
      [  556.539290] RBP: ffff8801f292f980 R08: ffffed003e73242d R09: ffffed003e73242d
      [  556.540709] R10: 0000000000000001 R11: ffffed003e73242c R12: 00000000fffffc64
      [  556.542131] R13: ffff8801f3992000 R14: 0000000000000058 R15: 00000000ffff8801
      [  556.543579] FS:  00007f8029297840(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
      [  556.545180] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  556.546338] CR2: 000055f5f57305d8 CR3: 00000001f18b0000 CR4: 00000000000006e0
      [  556.547809] ==================================================================
      [  556.549248] BUG: KASAN: stack-out-of-bounds in arch_tlb_gather_mmu+0x52/0x170
      [  556.550672] Write of size 8 at addr ffff8801f292fd10 by task umount/1310
      
      [  556.552338] CPU: 1 PID: 1310 Comm: umount Tainted: G      D           4.18.0-rc1+ #4
      [  556.553886] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  556.555756] Call Trace:
      [  556.556264]  dump_stack+0x7b/0xb5
      [  556.556944]  print_address_description+0x70/0x290
      [  556.557903]  kasan_report+0x291/0x390
      [  556.558649]  ? arch_tlb_gather_mmu+0x52/0x170
      [  556.559537]  __asan_store8+0x57/0x90
      [  556.560268]  arch_tlb_gather_mmu+0x52/0x170
      [  556.561110]  tlb_gather_mmu+0x12/0x40
      [  556.561862]  exit_mmap+0x123/0x2a0
      [  556.562555]  ? __ia32_sys_munmap+0x50/0x50
      [  556.563384]  ? exit_aio+0x98/0x230
      [  556.564079]  ? __x32_compat_sys_io_submit+0x260/0x260
      [  556.565099]  ? taskstats_exit+0x1f4/0x640
      [  556.565925]  ? kasan_check_read+0x11/0x20
      [  556.566739]  ? mm_update_next_owner+0x322/0x380
      [  556.567652]  mmput+0x8b/0x1d0
      [  556.568260]  do_exit+0x43a/0x1390
      [  556.568937]  ? mm_update_next_owner+0x380/0x380
      [  556.569855]  ? deactivate_super+0x5e/0x80
      [  556.570668]  ? cleanup_mnt+0x61/0xa0
      [  556.571395]  ? __cleanup_mnt+0x12/0x20
      [  556.572156]  ? task_work_run+0xc8/0xf0
      [  556.572917]  ? exit_to_usermode_loop+0x125/0x130
      [  556.573861]  rewind_stack_do_exit+0x17/0x20
      [  556.574707] RIP: 0033:0x7f8028b77487
      [  556.575428] Code: Bad RIP value.
      [  556.576106] RSP: 002b:00007fff9f2e3598 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
      [  556.577599] RAX: 0000000000000000 RBX: 0000000000ebd030 RCX: 00007f8028b77487
      [  556.579020] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000ec41e0
      [  556.580422] RBP: 0000000000ec41e0 R08: 0000000000000000 R09: 0000000000000014
      [  556.581833] R10: 00000000000006b2 R11: 0000000000000246 R12: 00007f802908083c
      [  556.583252] R13: 0000000000000000 R14: 0000000000ebd210 R15: 00007fff9f2e3820
      
      [  556.584983] The buggy address belongs to the page:
      [  556.585961] page:ffffea0007ca4bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      [  556.587540] flags: 0x2ffff0000000000()
      [  556.588296] raw: 02ffff0000000000 0000000000000000 dead000000000200 0000000000000000
      [  556.589822] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
      [  556.591359] page dumped because: kasan: bad access detected
      
      [  556.592786] Memory state around the buggy address:
      [  556.593753]  ffff8801f292fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  556.595191]  ffff8801f292fc80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
      [  556.596613] >ffff8801f292fd00: 00 00 f3 00 00 00 00 f3 f3 00 00 00 00 f4 f4 f4
      [  556.598044]                          ^
      [  556.598797]  ffff8801f292fd80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
      [  556.600225]  ffff8801f292fe00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f4 f4 f4
      [  556.601647] ==================================================================
      
      - Location
      https://elixir.bootlin.com/linux/v4.18-rc1/source/fs/f2fs/node.c#L987
      		case NODE_DIND_BLOCK:
      			err = truncate_nodes(&dn, nofs, offset[1], 3);
      			cont = 0;
      			break;
      
      		default:
      			BUG(); <---
      		}
      
      Reported-by Wen Xu <wen.xu@gatech.edu>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1c879805
    • Ben Hutchings's avatar
      f2fs: Add sanity_check_inode() function · fd8c7d35
      Ben Hutchings authored
      This was done as part of commits 5d64600d4f33 "f2fs: avoid bug_on on
      corrupted inode" and 76d56d4ab4f2 "f2fs: fix to do sanity check with
      extra_attr feature" upstream, but the specific checks they added are
      not applicable to 4.9.
      
      Cc: Jaegeuk Kim <jaegeuk@kernel.org>
      Cc: Chao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fd8c7d35
    • Chao Yu's avatar
      f2fs: fix to do sanity check with user_block_count · 06e606ac
      Chao Yu authored
      commit 9dc956b2c8523aed39d1e6508438be9fea28c8fc upstream.
      
      This patch fixs to do sanity check with user_block_count.
      
      - Overview
      Divide zero in utilization when mount() a corrupted f2fs image
      
      - Reproduce (4.18 upstream kernel)
      
      - Kernel message
      [  564.099503] F2FS-fs (loop0): invalid crc value
      [  564.101991] divide error: 0000 [#1] SMP KASAN PTI
      [  564.103103] CPU: 1 PID: 1298 Comm: f2fs_discard-7: Not tainted 4.18.0-rc1+ #4
      [  564.104584] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  564.106624] RIP: 0010:issue_discard_thread+0x248/0x5c0
      [  564.107692] Code: ff ff 48 8b bd e8 fe ff ff 41 8b 9d 4c 04 00 00 e8 cd b8 ad ff 41 8b 85 50 04 00 00 31 d2 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <48> f7 f3 83 f8 50 7e 16 41 c7 86 7c ff ff ff 01 00 00 00 41 c7 86
      [  564.111686] RSP: 0018:ffff8801f3117dc0 EFLAGS: 00010206
      [  564.112775] RAX: 0000000000000384 RBX: 0000000000000000 RCX: ffffffffb88c1e03
      [  564.114250] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff8801e3aa4850
      [  564.115706] RBP: ffff8801f3117f00 R08: 1ffffffff751a1d0 R09: fffffbfff751a1d0
      [  564.117177] R10: 0000000000000001 R11: fffffbfff751a1d0 R12: 00000000fffffffc
      [  564.118634] R13: ffff8801e3aa4400 R14: ffff8801f3117ed8 R15: ffff8801e2050000
      [  564.120094] FS:  0000000000000000(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
      [  564.121748] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  564.122923] CR2: 000000000202b078 CR3: 00000001f11ac000 CR4: 00000000000006e0
      [  564.124383] Call Trace:
      [  564.124924]  ? __issue_discard_cmd+0x480/0x480
      [  564.125882]  ? __sched_text_start+0x8/0x8
      [  564.126756]  ? __kthread_parkme+0xcb/0x100
      [  564.127620]  ? kthread_blkcg+0x70/0x70
      [  564.128412]  kthread+0x180/0x1d0
      [  564.129105]  ? __issue_discard_cmd+0x480/0x480
      [  564.130029]  ? kthread_associate_blkcg+0x150/0x150
      [  564.131033]  ret_from_fork+0x35/0x40
      [  564.131794] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too crct10dif_pclmul crc32_pclmul qxl drm_kms_helper syscopyarea aesni_intel sysfillrect sysimgblt fb_sys_fops ttm drm aes_x86_64 crypto_simd cryptd 8139cp glue_helper mii pata_acpi floppy
      [  564.141798] ---[ end trace 4ce02f25ff7d3df5 ]---
      [  564.142773] RIP: 0010:issue_discard_thread+0x248/0x5c0
      [  564.143885] Code: ff ff 48 8b bd e8 fe ff ff 41 8b 9d 4c 04 00 00 e8 cd b8 ad ff 41 8b 85 50 04 00 00 31 d2 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <48> f7 f3 83 f8 50 7e 16 41 c7 86 7c ff ff ff 01 00 00 00 41 c7 86
      [  564.147776] RSP: 0018:ffff8801f3117dc0 EFLAGS: 00010206
      [  564.148856] RAX: 0000000000000384 RBX: 0000000000000000 RCX: ffffffffb88c1e03
      [  564.150424] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff8801e3aa4850
      [  564.151906] RBP: ffff8801f3117f00 R08: 1ffffffff751a1d0 R09: fffffbfff751a1d0
      [  564.153463] R10: 0000000000000001 R11: fffffbfff751a1d0 R12: 00000000fffffffc
      [  564.154915] R13: ffff8801e3aa4400 R14: ffff8801f3117ed8 R15: ffff8801e2050000
      [  564.156405] FS:  0000000000000000(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
      [  564.158070] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  564.159279] CR2: 000000000202b078 CR3: 00000001f11ac000 CR4: 00000000000006e0
      [  564.161043] ==================================================================
      [  564.162587] BUG: KASAN: stack-out-of-bounds in from_kuid_munged+0x1d/0x50
      [  564.163994] Read of size 4 at addr ffff8801f3117c84 by task f2fs_discard-7:/1298
      
      [  564.165852] CPU: 1 PID: 1298 Comm: f2fs_discard-7: Tainted: G      D           4.18.0-rc1+ #4
      [  564.167593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  564.169522] Call Trace:
      [  564.170057]  dump_stack+0x7b/0xb5
      [  564.170778]  print_address_description+0x70/0x290
      [  564.171765]  kasan_report+0x291/0x390
      [  564.172540]  ? from_kuid_munged+0x1d/0x50
      [  564.173408]  __asan_load4+0x78/0x80
      [  564.174148]  from_kuid_munged+0x1d/0x50
      [  564.174962]  do_notify_parent+0x1f5/0x4f0
      [  564.175808]  ? send_sigqueue+0x390/0x390
      [  564.176639]  ? css_set_move_task+0x152/0x340
      [  564.184197]  do_exit+0x1290/0x1390
      [  564.184950]  ? __issue_discard_cmd+0x480/0x480
      [  564.185884]  ? mm_update_next_owner+0x380/0x380
      [  564.186829]  ? __sched_text_start+0x8/0x8
      [  564.187672]  ? __kthread_parkme+0xcb/0x100
      [  564.188528]  ? kthread_blkcg+0x70/0x70
      [  564.189333]  ? kthread+0x180/0x1d0
      [  564.190052]  ? __issue_discard_cmd+0x480/0x480
      [  564.190983]  rewind_stack_do_exit+0x17/0x20
      
      [  564.192190] The buggy address belongs to the page:
      [  564.193213] page:ffffea0007cc45c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      [  564.194856] flags: 0x2ffff0000000000()
      [  564.195644] raw: 02ffff0000000000 0000000000000000 dead000000000200 0000000000000000
      [  564.197247] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
      [  564.198826] page dumped because: kasan: bad access detected
      
      [  564.200299] Memory state around the buggy address:
      [  564.201306]  ffff8801f3117b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  564.202779]  ffff8801f3117c00: 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3
      [  564.204252] >ffff8801f3117c80: f3 f3 f3 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
      [  564.205742]                    ^
      [  564.206424]  ffff8801f3117d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  564.207908]  ffff8801f3117d80: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
      [  564.209389] ==================================================================
      [  564.231795] F2FS-fs (loop0): Mounted with checkpoint version = 2
      
      - Location
      https://elixir.bootlin.com/linux/v4.18-rc1/source/fs/f2fs/segment.h#L586
      	return div_u64((u64)valid_user_blocks(sbi) * 100,
      					sbi->user_block_count);
      Missing checks on sbi->user_block_count.
      Reported-by: 's avatarWen Xu <wen.xu@gatech.edu>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      06e606ac
    • Chao Yu's avatar
      f2fs: fix to do sanity check with secs_per_zone · a3dccfac
      Chao Yu authored
      commit 42bf546c1fe3f3654bdf914e977acbc2b80a5be5 upstream.
      
      As Wen Xu reported in below link:
      
      https://bugzilla.kernel.org/show_bug.cgi?id=200183
      
      - Overview
      Divide zero in reset_curseg() when mounting a crafted f2fs image
      
      - Reproduce
      
      - Kernel message
      [  588.281510] divide error: 0000 [#1] SMP KASAN PTI
      [  588.282701] CPU: 0 PID: 1293 Comm: mount Not tainted 4.18.0-rc1+ #4
      [  588.284000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [  588.286178] RIP: 0010:reset_curseg+0x94/0x1a0
      [  588.298166] RSP: 0018:ffff8801e88d7940 EFLAGS: 00010246
      [  588.299360] RAX: 0000000000000014 RBX: ffff8801e1d46d00 RCX: ffffffffb88bf60b
      [  588.300809] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff8801e1d46d64
      [  588.305272] R13: 0000000000000000 R14: 0000000000000014 R15: 0000000000000000
      [  588.306822] FS:  00007fad85008840(0000) GS:ffff8801f6e00000(0000) knlGS:0000000000000000
      [  588.308456] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  588.309623] CR2: 0000000001705078 CR3: 00000001f30f8000 CR4: 00000000000006f0
      [  588.311085] Call Trace:
      [  588.311637]  f2fs_build_segment_manager+0x103f/0x3410
      [  588.316136]  ? f2fs_commit_super+0x1b0/0x1b0
      [  588.317031]  ? set_blocksize+0x90/0x140
      [  588.319473]  f2fs_mount+0x15/0x20
      [  588.320166]  mount_fs+0x60/0x1a0
      [  588.320847]  ? alloc_vfsmnt+0x309/0x360
      [  588.321647]  vfs_kern_mount+0x6b/0x1a0
      [  588.322432]  do_mount+0x34a/0x18c0
      [  588.323175]  ? strndup_user+0x46/0x70
      [  588.323937]  ? copy_mount_string+0x20/0x20
      [  588.324793]  ? memcg_kmem_put_cache+0x1b/0xa0
      [  588.325702]  ? kasan_check_write+0x14/0x20
      [  588.326562]  ? _copy_from_user+0x6a/0x90
      [  588.327375]  ? memdup_user+0x42/0x60
      [  588.328118]  ksys_mount+0x83/0xd0
      [  588.328808]  __x64_sys_mount+0x67/0x80
      [  588.329607]  do_syscall_64+0x78/0x170
      [  588.330400]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  588.331461] RIP: 0033:0x7fad848e8b9a
      [  588.336022] RSP: 002b:00007ffd7c5b6be8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
      [  588.337547] RAX: ffffffffffffffda RBX: 00000000016f8030 RCX: 00007fad848e8b9a
      [  588.338999] RDX: 00000000016f8210 RSI: 00000000016f9f30 RDI: 0000000001700ec0
      [  588.340442] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
      [  588.341887] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000000001700ec0
      [  588.343341] R13: 00000000016f8210 R14: 0000000000000000 R15: 0000000000000003
      [  588.354891] ---[ end trace 4ce02f25ff7d3df5 ]---
      [  588.355862] RIP: 0010:reset_curseg+0x94/0x1a0
      [  588.360742] RSP: 0018:ffff8801e88d7940 EFLAGS: 00010246
      [  588.361812] RAX: 0000000000000014 RBX: ffff8801e1d46d00 RCX: ffffffffb88bf60b
      [  588.363485] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff8801e1d46d64
      [  588.365213] RBP: ffff8801e88d7968 R08: ffffed003c32266f R09: ffffed003c32266f
      [  588.366661] R10: 0000000000000001 R11: ffffed003c32266e R12: ffff8801f0337700
      [  588.368110] R13: 0000000000000000 R14: 0000000000000014 R15: 0000000000000000
      [  588.370057] FS:  00007fad85008840(0000) GS:ffff8801f6e00000(0000) knlGS:0000000000000000
      [  588.372099] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  588.373291] CR2: 0000000001705078 CR3: 00000001f30f8000 CR4: 00000000000006f0
      
      - Location
      https://elixir.bootlin.com/linux/latest/source/fs/f2fs/segment.c#L2147
              curseg->zone = GET_ZONE_FROM_SEG(sbi, curseg->segno);
      
      If secs_per_zone is corrupted due to fuzzing test, it will cause divide
      zero operation when using GET_ZONE_FROM_SEG macro, so we should do more
      sanity check with secs_per_zone during mount to avoid this issue.
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a3dccfac
    • Chao Yu's avatar
      f2fs: introduce and spread verify_blkaddr · d4511881
      Chao Yu authored
      commit e1da7872f6eda977bd812346bf588c35e4495a1e upstream.
      
      This patch introduces verify_blkaddr to check meta/data block address
      with valid range to detect bug earlier.
      
      In addition, once we encounter an invalid blkaddr, notice user to run
      fsck to fix, and let the kernel panic.
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9:
       - I skipped an earlier renaming of is_valid_meta_blkaddr() to
         f2fs_is_valid_meta_blkaddr()
       - Adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d4511881
    • Chao Yu's avatar
      f2fs: clean up with is_valid_blkaddr() · 6012d18d
      Chao Yu authored
      commit 7b525dd01365c6764018e374d391c92466be1b7a upstream.
      
      - rename is_valid_blkaddr() to is_valid_meta_blkaddr() for readability.
      - introduce is_valid_blkaddr() for cleanup.
      
      No logic change in this patch.
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6012d18d
    • Jaegeuk Kim's avatar
      f2fs: enhance sanity_check_raw_super() to avoid potential overflow · 65e1055a
      Jaegeuk Kim authored
      commit 0cfe75c5b011994651a4ca6d74f20aa997bfc69a upstream.
      
      In order to avoid the below overflow issue, we should have checked the
      boundaries in superblock before reaching out to allocation. As Linus suggested,
      the right place should be sanity_check_raw_super().
      
      Dr Silvio Cesare of InfoSect reported:
      
      There are integer overflows with using the cp_payload superblock field in the
      f2fs filesystem potentially leading to memory corruption.
      
      include/linux/f2fs_fs.h
      
      struct f2fs_super_block {
      ...
              __le32 cp_payload;
      
      fs/f2fs/f2fs.h
      
      typedef u32 block_t;    /*
                               * should not change u32, since it is the on-disk block
                               * address format, __le32.
                               */
      ...
      
      static inline block_t __cp_payload(struct f2fs_sb_info *sbi)
      {
              return le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_payload);
      }
      
      fs/f2fs/checkpoint.c
      
              block_t start_blk, orphan_blocks, i, j;
      ...
              start_blk = __start_cp_addr(sbi) + 1 + __cp_payload(sbi);
              orphan_blocks = __start_sum_addr(sbi) - 1 - __cp_payload(sbi);
      
      +++ integer overflows
      
      ...
              unsigned int cp_blks = 1 + __cp_payload(sbi);
      ...
              sbi->ckpt = kzalloc(cp_blks * blk_size, GFP_KERNEL);
      
      +++ integer overflow leading to incorrect heap allocation.
      
              int cp_payload_blks = __cp_payload(sbi);
      ...
              ckpt->cp_pack_start_sum = cpu_to_le32(1 + cp_payload_blks +
                              orphan_blocks);
      
      +++ sign bug and integer overflow
      
      ...
              for (i = 1; i < 1 + cp_payload_blks; i++)
      
      +++ integer overflow
      
      ...
      
            sbi->max_orphans = (sbi->blocks_per_seg - F2FS_CP_PACKS -
                              NR_CURSEG_TYPE - __cp_payload(sbi)) *
                                      F2FS_ORPHANS_PER_BLOCK;
      
      +++ integer overflow
      Reported-by: 's avatarGreg KH <greg@kroah.com>
      Reported-by: 's avatarSilvio Cesare <silvio.cesare@gmail.com>
      Suggested-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      Reviewed-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: No hot file extension support]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      65e1055a
    • Jaegeuk Kim's avatar
      f2fs: sanity check on sit entry · 6e182e91
      Jaegeuk Kim authored
      commit b2ca374f33bd33fd822eb871876e4888cf79dc97 upstream.
      
      syzbot hit the following crash on upstream commit
      87ef12027b9b1dd0e0b12cf311fbcb19f9d92539 (Wed Apr 18 19:48:17 2018 +0000)
      Merge tag 'ceph-for-4.17-rc2' of git://github.com/ceph/ceph-client
      syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=83699adeb2d13579c31e
      
      C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5805208181407744
      syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=6005073343676416
      Raw console output: https://syzkaller.appspot.com/x/log.txt?id=6555047731134464
      Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118
      compiler: gcc (GCC) 8.0.1 20180413 (experimental)
      
      IMPORTANT: if you fix the bug, please add the following tag to the commit:
      Reported-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com
      It will help syzbot understand when the bug is fixed. See footer for details.
      If you forward the report, please keep this part and the footer.
      
      F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
      F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
      F2FS-fs (loop0): invalid crc value
      BUG: unable to handle kernel paging request at ffffed006b2a50c0
      PGD 21ffee067 P4D 21ffee067 PUD 21fbeb067 PMD 0
      Oops: 0000 [#1] SMP KASAN
      Dumping ftrace buffer:
         (ftrace buffer empty)
      Modules linked in:
      CPU: 0 PID: 4514 Comm: syzkaller989480 Not tainted 4.17.0-rc1+ #8
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:build_sit_entries fs/f2fs/segment.c:3653 [inline]
      RIP: 0010:build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852
      RSP: 0018:ffff8801b102e5b0 EFLAGS: 00010a06
      RAX: 1ffff1006b2a50c0 RBX: 0000000000000004 RCX: 0000000000000001
      RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801ac74243e
      RBP: ffff8801b102f410 R08: ffff8801acbd46c0 R09: fffffbfff14d9af8
      R10: fffffbfff14d9af8 R11: ffff8801acbd46c0 R12: ffff8801ac742a80
      R13: ffff8801d9519100 R14: dffffc0000000000 R15: ffff880359528600
      FS:  0000000001e04880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffffed006b2a50c0 CR3: 00000001ac6ac000 CR4: 00000000001406f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       f2fs_fill_super+0x4095/0x7bf0 fs/f2fs/super.c:2803
       mount_bdev+0x30c/0x3e0 fs/super.c:1165
       f2fs_mount+0x34/0x40 fs/f2fs/super.c:3020
       mount_fs+0xae/0x328 fs/super.c:1268
       vfs_kern_mount.part.34+0xd4/0x4d0 fs/namespace.c:1037
       vfs_kern_mount fs/namespace.c:1027 [inline]
       do_new_mount fs/namespace.c:2517 [inline]
       do_mount+0x564/0x3070 fs/namespace.c:2847
       ksys_mount+0x12d/0x140 fs/namespace.c:3063
       __do_sys_mount fs/namespace.c:3077 [inline]
       __se_sys_mount fs/namespace.c:3074 [inline]
       __x64_sys_mount+0xbe/0x150 fs/namespace.c:3074
       do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x443d6a
      RSP: 002b:00007ffd312813c8 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
      RAX: ffffffffffffffda RBX: 0000000020000c00 RCX: 0000000000443d6a
      RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd312813d0
      RBP: 0000000000000003 R08: 0000000020016a00 R09: 000000000000000a
      R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000004
      R13: 0000000000402c60 R14: 0000000000000000 R15: 0000000000000000
      RIP: build_sit_entries fs/f2fs/segment.c:3653 [inline] RSP: ffff8801b102e5b0
      RIP: build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852 RSP: ffff8801b102e5b0
      CR2: ffffed006b2a50c0
      ---[ end trace a2034989e196ff17 ]---
      
      Reported-and-tested-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com
      Reviewed-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6e182e91
    • Yunlei He's avatar
      f2fs: check blkaddr more accuratly before issue a bio · 89d78cf5
      Yunlei He authored
      commit 0833721ec3658a4e9d5e58b6fa82cf9edc431e59 upstream.
      
      This patch check blkaddr more accuratly before issue a
      write or read bio.
      Signed-off-by: 's avatarYunlei He <heyunlei@huawei.com>
      Reviewed-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      89d78cf5
    • Jaegeuk Kim's avatar
      f2fs: return error during fill_super · 3fd96204
      Jaegeuk Kim authored
      commit c39a1b34 upstream.
      
      Let's avoid BUG_ON during fill_super, when on-disk was totall corrupted.
      Reviewed-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarSudip Mukherjee <sudipm.mukherjee@gmail.com>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3fd96204
    • Jaegeuk Kim's avatar
      f2fs: detect wrong layout · 240ceff4
      Jaegeuk Kim authored
      commit 2040fce8 upstream.
      
      Previous mkfs.f2fs allows small partition inappropriately, so f2fs should detect
      that as well.
      
      Refer this in f2fs-tools.
      
      mkfs.f2fs: detect small partition by overprovision ratio and # of segments
      Reported-and-Tested-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      240ceff4
    • Chao Yu's avatar
      f2fs: fix race condition in between free nid allocator/initializer · cb9b1d4e
      Chao Yu authored
      commit 30a61ddf upstream.
      
      In below concurrent case, allocated nid can be loaded into free nid cache
      and be allocated again.
      
      Thread A				Thread B
      - f2fs_create
       - f2fs_new_inode
        - alloc_nid
         - __insert_nid_to_list(ALLOC_NID_LIST)
      					- f2fs_balance_fs_bg
      					 - build_free_nids
      					  - __build_free_nids
      					   - scan_nat_page
      					    - add_free_nid
      					     - __lookup_nat_cache
       - f2fs_add_link
        - init_inode_metadata
         - new_inode_page
          - new_node_page
           - set_node_addr
       - alloc_nid_done
        - __remove_nid_from_list(ALLOC_NID_LIST)
      					     - __insert_nid_to_list(FREE_NID_LIST)
      
      This patch makes nat cache lookup and free nid list operation being atomical
      to avoid this race condition.
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9:
       - add_free_nid() returns 0 in case of any error (except low memory)
       - Tree/list addition has not been moved into __insert_nid_to_list()]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cb9b1d4e
    • Yunlei He's avatar
      f2fs: fix a panic caused by NULL flush_cmd_control · 3b19f961
      Yunlei He authored
      commit d4fdf8ba upstream.
      
      Mount fs with option noflush_merge, boot failed for illegal address
      fcc in function f2fs_issue_flush:
      
              if (!test_opt(sbi, FLUSH_MERGE)) {
                      ret = submit_flush_wait(sbi);
                      atomic_inc(&fcc->issued_flush);   ->  Here, fcc illegal
                      return ret;
              }
      Signed-off-by: 's avatarYunlei He <heyunlei@huawei.com>
      Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
      [bwh: Backported to 4.9: adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3b19f961
    • Shaokun Zhang's avatar
      btrfs: tree-checker: Fix misleading group system information · d558df73
      Shaokun Zhang authored
      commit 761333f2f50ccc887aa9957ae829300262c0d15b upstream.
      
      block_group_err shows the group system as a decimal value with a '0x'
      prefix, which is somewhat misleading.
      
      Fix it to print hexadecimal, as was intended.
      
      Fixes: fce466eab7ac6 ("btrfs: tree-checker: Verify block_group_item")
      Reviewed-by: 's avatarNikolay Borisov <nborisov@suse.com>
      Reviewed-by: 's avatarQu Wenruo <wqu@suse.com>
      Signed-off-by: 's avatarShaokun Zhang <zhangshaokun@hisilicon.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d558df73
    • Qu Wenruo's avatar
      btrfs: tree-checker: Check level for leaves and nodes · fbf8bd36
      Qu Wenruo authored
      commit f556faa46eb4e96d0d0772e74ecf66781e132f72 upstream.
      
      Although we have tree level check at tree read runtime, it's completely
      based on its parent level.
      We still need to do accurate level check to avoid invalid tree blocks
      sneak into kernel space.
      
      The check itself is simple, for leaf its level should always be 0.
      For nodes its level should be in range [1, BTRFS_MAX_LEVEL - 1].
      Signed-off-by: 's avatarQu Wenruo <wqu@suse.com>
      Reviewed-by: 's avatarSu Yue <suy.fnst@cn.fujitsu.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      [bwh: Backported to 4.9:
       - Pass root instead of fs_info to generic_err()
       - Adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fbf8bd36
    • Qu Wenruo's avatar
      btrfs: Check that each block group has corresponding chunk at mount time · 7a72f918
      Qu Wenruo authored
      commit 514c7dca85a0bf40be984dab0b477403a6db901f upstream.
      
      A crafted btrfs image with incorrect chunk<->block group mapping will
      trigger a lot of unexpected things as the mapping is essential.
      
      Although the problem can be caught by block group item checker
      added in "btrfs: tree-checker: Verify block_group_item", it's still not
      sufficient.  A sufficiently valid block group item can pass the check
      added by the mentioned patch but could fail to match the existing chunk.
      
      This patch will add extra block group -> chunk mapping check, to ensure
      we have a completely matching (start, len, flags) chunk for each block
      group at mount time.
      
      Here we reuse the original helper find_first_block_group(), which is
      already doing the basic bg -> chunk checks, adding further checks of the
      start/len and type flags.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=199837Reported-by: 's avatarXu Wen <wen.xu@gatech.edu>
      Signed-off-by: 's avatarQu Wenruo <wqu@suse.com>
      Reviewed-by: 's avatarSu Yue <suy.fnst@cn.fujitsu.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      [bwh: Backported to 4.9: Use root->fs_info instead of fs_info]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a72f918
    • Qu Wenruo's avatar
      btrfs: tree-checker: Detect invalid and empty essential trees · 6f33d3d8
      Qu Wenruo authored
      commit ba480dd4db9f1798541eb2d1c423fc95feee8d36 upstream.
      
      A crafted image has empty root tree block, which will later cause NULL
      pointer dereference.
      
      The following trees should never be empty:
      1) Tree root
         Must contain at least root items for extent tree, device tree and fs
         tree
      
      2) Chunk tree
         Or we can't even bootstrap as it contains the mapping.
      
      3) Fs tree
         At least inode item for top level inode (.).
      
      4) Device tree
         Dev extents for chunks
      
      5) Extent tree
         Must have corresponding extent for each chunk.
      
      If any of them is empty, we are sure the fs is corrupted and no need to
      mount it.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=199847Reported-by: 's avatarXu Wen <wen.xu@gatech.edu>
      Signed-off-by: 's avatarQu Wenruo <wqu@suse.com>
      Tested-by: 's avatarGu Jinxiang <gujx@cn.fujitsu.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      [bwh: Backported to 4.9: Pass root instead of fs_info to generic_err()]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6f33d3d8
    • Qu Wenruo's avatar
      btrfs: tree-checker: Verify block_group_item · 058e388e
      Qu Wenruo authored
      commit fce466eab7ac6baa9d2dcd88abcf945be3d4a089 upstream.
      
      A crafted image with invalid block group items could make free space cache
      code to cause panic.
      
      We could detect such invalid block group item by checking:
      1) Item size
         Known fixed value.
      2) Block group size (key.offset)
         We have an upper limit on block group item (10G)
      3) Chunk objectid
         Known fixed value.
      4) Type
         Only 4 valid type values, DATA, METADATA, SYSTEM and DATA|METADATA.
         No more than 1 bit set for profile type.
      5) Used space
         No more than the block group size.
      
      This should allow btrfs to detect and refuse to mount the crafted image.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=199849Reported-by: 's avatarXu Wen <wen.xu@gatech.edu>
      Signed-off-by: 's avatarQu Wenruo <wqu@suse.com>
      Reviewed-by: 's avatarGu Jinxiang <gujx@cn.fujitsu.com>
      Reviewed-by: 's avatarNikolay Borisov <nborisov@suse.com>
      Tested-by: 's avatarGu Jinxiang <gujx@cn.fujitsu.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      [bwh: Backported to 4.9:
       - In check_leaf_item(), pass root->fs_info to check_block_group_item()
       - Adjust context]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      058e388e
    • David Sterba's avatar
      btrfs: tree-check: reduce stack consumption in check_dir_item · db438c33
      David Sterba authored
      commit e2683fc9 upstream.
      
      I've noticed that the updated item checker stack consumption increased
      dramatically in 542f5385e20cf97447 ("btrfs: tree-checker: Add checker
      for dir item")
      
      tree-checker.c:check_leaf                    +552 (176 -> 728)
      
      The array is 255 bytes long, dynamic allocation would slow down the
      sanity checks so it's more reasonable to keep it on-stack. Moving the
      variable to the scope of use reduces the stack usage again
      
      tree-checker.c:check_leaf                    -264 (728 -> 464)
      Reviewed-by: 's avatarJosef Bacik <jbacik@fb.com>
      Reviewed-by: 's avatarQu Wenruo <wqu@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      db438c33
    • Arnd Bergmann's avatar
      btrfs: tree-checker: use %zu format string for size_t · 6b66f518
      Arnd Bergmann authored
      commit 7cfad652 upstream.
      
      The return value of sizeof() is of type size_t, so we must print it
      using the %z format modifier rather than %l to avoid this warning
      on some architectures:
      
      fs/btrfs/tree-checker.c: In function 'check_dir_item':
      fs/btrfs/tree-checker.c:273:50: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'u32' {aka 'unsigned int'} [-Werror=format=]
      
      Fixes: 005887f2e3e0 ("btrfs: tree-checker: Add checker for dir item")
      Signed-off-by: 's avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6b66f518
    • Qu Wenruo's avatar
      btrfs: tree-checker: Add checker for dir item · e48e62f5
      Qu Wenruo authored
      commit ad7b0368 upstream.
      
      Add checker for dir item, for key types DIR_ITEM, DIR_INDEX and
      XATTR_ITEM.
      
      This checker does comprehensive checks for:
      
      1) dir_item header and its data size
         Against item boundary and maximum name/xattr length.
         This part is mostly the same as old verify_dir_item().
      
      2) dir_type
         Against maximum file types, and against key type.
         Since XATTR key should only have FT_XATTR dir item, and normal dir
         item type should not have XATTR key.
      
         The check between key->type and dir_type is newly introduced by this
         patch.
      
      3) name hash
         For XATTR and DIR_ITEM key, key->offset is name hash (crc32c).
         Check the hash of the name against the key to ensure it's correct.
      
         The name hash check is only found in btrfs-progs before this patch.
      Signed-off-by: 's avatarQu Wenruo <wqu@suse.com>
      Reviewed-by: 's avatarNikolay Borisov <nborisov@suse.com>
      Reviewed-by: 's avatarSu Yue <suy.fnst@cn.fujitsu.com>
      Reviewed-by: 's avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: 's avatarDavid Sterba <dsterba@suse.com>
      [bwh: Backported to 4.9: BTRFS_MAX_XATTR_SIZE() takes a root not an fs_info]
      Signed-off-by: 's avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e48e62f5