Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
kernel-fxtec-pro1x/fs/f2fs
History
Chao Yu f552d88c0d f2fs: fix to check segment boundary during SIT page readahead 
[ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]

As syzbot reported:

kernel BUG at fs/f2fs/segment.h:657!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657
Call Trace:
 build_sit_entries fs/f2fs/segment.c:4195 [inline]
 f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779
 f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633
 mount_bdev+0x32e/0x3f0 fs/super.c:1417
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1547
 do_new_mount fs/namespace.c:2875 [inline]
 path_mount+0x1387/0x2070 fs/namespace.c:3192
 do_mount fs/namespace.c:3205 [inline]
 __do_sys_mount fs/namespace.c:3413 [inline]
 __se_sys_mount fs/namespace.c:3390 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

@blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic
in following sanity check in current_sit_addr(), add check condition to
avoid this issue.

Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-05 11:08:39 +01:00
..
acl.c f2fs: fix wrong return value of f2fs_acl_create 2019-02-12 19:47:02 +01:00
acl.h f2fs: remove dead code f2fs_check_acl 2016-09-14 16:52:36 -07:00
checkpoint.c f2fs: fix to check segment boundary during SIT page readahead 2020-11-05 11:08:39 +01:00
data.c f2fs: Return EOF on unaligned end of file DIO read 2020-09-23 12:10:59 +02:00
debug.c f2fs: don't access node/meta inode mapping after iput 2019-07-10 09:53:45 +02:00
dir.c f2fs: fix uninit-value in f2fs_lookup 2020-11-05 11:08:39 +01:00
extent_cache.c f2fs: avoid sleeping under spin_lock 2018-11-13 11:08:37 -08:00
f2fs.h f2fs: fix error path in do_recover_data() 2020-09-03 11:24:20 +02:00
file.c f2fs: fix potential overflow 2020-01-17 19:47:13 +01:00
gc.c f2fs: fix to allow node segment for GC by ioctl path 2019-12-13 08:51:51 +01:00
gc.h f2fs: introduce sbi->gc_mode to determine the policy 2018-05-31 11:31:51 -07:00
hash.c f2fs: check entire encrypted bigname when finding a dentry 2017-05-04 11:44:35 -04:00
inline.c f2fs: fix error path in do_recover_data() 2020-09-03 11:24:20 +02:00
inode.c f2fs: fix to update time in lazytime mode 2020-01-04 19:12:37 +01:00
Kconfig fs/*/Kconfig: drop links to 404-compliant http://acl.bestbits.at 2018-01-01 12:45:37 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
namei.c fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext 2020-11-05 11:08:35 +01:00
node.c f2fs: fix indefinite loop scanning for free nid 2020-09-23 12:10:58 +02:00
node.h f2fs: let checkpoint flush dnode page of regular 2018-08-01 11:52:36 -07:00
recovery.c f2fs: fix error path in do_recover_data() 2020-09-03 11:24:20 +02:00
segment.c f2fs: fix to account preflush command for noflush_merge mode 2019-12-13 08:51:48 +01:00
segment.h f2fs: use generic EFSBADCRC/EFSCORRUPTED 2019-10-01 08:26:13 +02:00
shrinker.c f2fs: fix sbi->extent_list corruption issue 2019-02-12 19:47:17 +01:00
super.c f2fs: fix use-after-free issue 2020-09-03 11:24:21 +02:00
sysfs.c f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info 2020-10-30 10:38:20 +01:00
trace.c f2fs: do not use mutex lock in atomic context 2019-04-05 22:32:59 +02:00
trace.h
xattr.c f2fs: fix to avoid memory leakage in f2fs_listxattr 2020-04-29 16:31:17 +02:00
xattr.h f2fs: fix to avoid accessing xattr across the boundary 2019-06-19 08:18:02 +02:00