mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 22:25:03 +00:00
5b5b4f85b0
As bughunter reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215709 f2fs may hang when mounting a fuzzed image, the dmesg shows as below: __filemap_get_folio+0x3a9/0x590 pagecache_get_page+0x18/0x60 __get_meta_page+0x95/0x460 [f2fs] get_checkpoint_version+0x2a/0x1e0 [f2fs] validate_checkpoint+0x8e/0x2a0 [f2fs] f2fs_get_valid_checkpoint+0xd0/0x620 [f2fs] f2fs_fill_super+0xc01/0x1d40 [f2fs] mount_bdev+0x18a/0x1c0 f2fs_mount+0x15/0x20 [f2fs] legacy_get_tree+0x28/0x50 vfs_get_tree+0x27/0xc0 path_mount+0x480/0xaa0 do_mount+0x7c/0xa0 __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is cp_pack_total_block_count field in checkpoint was fuzzed to one, as calcuated, two cp pack block locates in the same block address, so then read latter cp pack block, it will block on the page lock due to the lock has already held when reading previous cp pack block, fix it by adding sanity check for cp_pack_total_block_count. Cc: stable@vger.kernel.org Signed-off-by: Chao Yu <chao.yu@oppo.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> |
||
|---|---|---|
| .. | ||
| acl.c | ||
| acl.h | ||
| checkpoint.c | ||
| compress.c | ||
| data.c | ||
| debug.c | ||
| dir.c | ||
| extent_cache.c | ||
| f2fs.h | ||
| file.c | ||
| gc.c | ||
| gc.h | ||
| hash.c | ||
| inline.c | ||
| inode.c | ||
| iostat.c | ||
| iostat.h | ||
| Kconfig | ||
| Makefile | ||
| namei.c | ||
| node.c | ||
| node.h | ||
| recovery.c | ||
| segment.c | ||
| segment.h | ||
| shrinker.c | ||
| super.c | ||
| sysfs.c | ||
| verity.c | ||
| xattr.c | ||
| xattr.h | ||