linux-stable/fs/f2fs
Chao Yu 626bcf2b7c f2fs: fix to do sanity check on free nid
As Jungyeon reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=203225

- Overview
When mounting the attached crafted image and unmounting it, following errors are reported.
Additionally, it hangs on sync after unmounting.

The image is intentionally fuzzed from a normal f2fs image for testing.
Compile options for F2FS are as follows.
CONFIG_F2FS_FS=y
CONFIG_F2FS_STAT_FS=y
CONFIG_F2FS_FS_XATTR=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_F2FS_CHECK_FS=y

- Reproduces
mkdir test
mount -t f2fs tmp.img test
touch test/t
umount test
sync

- Messages
 kernel BUG at fs/f2fs/node.c:3073!
 RIP: 0010:f2fs_destroy_node_manager+0x2f0/0x300
 Call Trace:
  f2fs_put_super+0xf4/0x270
  generic_shutdown_super+0x62/0x110
  kill_block_super+0x1c/0x50
  kill_f2fs_super+0xad/0xd0
  deactivate_locked_super+0x35/0x60
  cleanup_mnt+0x36/0x70
  task_work_run+0x75/0x90
  exit_to_usermode_loop+0x93/0xa0
  do_syscall_64+0xba/0xf0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0010:f2fs_destroy_node_manager+0x2f0/0x300

NAT table is corrupted, so reserved meta/node inode ids were added into
free list incorrectly, during file creation, since reserved id has cached
in inode hash, so it fails the creation and preallocated nid can not be
released later, result in kernel panic.

To fix this issue, let's do nid boundary check during free nid loading.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2019-05-08 21:23:09 -07:00
..
acl.c f2fs: use kvmalloc, if kmalloc is failed 2018-12-26 15:16:53 -08:00
acl.h f2fs: add SPDX license identifiers 2018-09-12 13:07:10 -07:00
checkpoint.c f2fs: fix wrong __is_meta_io() macro 2019-05-08 21:23:07 -07:00
data.c f2fs: fix wrong __is_meta_io() macro 2019-05-08 21:23:07 -07:00
debug.c f2fs: no need to check return value of debugfs_create functions 2019-01-22 14:25:25 +01:00
dir.c f2fs-for-5.1-rc1 2019-03-15 13:42:53 -07:00
extent_cache.c f2fs: fix to initialize variable to avoid UBSAN/smatch warning 2019-01-22 15:31:26 -08:00
f2fs.h f2fs: fix wrong __is_meta_io() macro 2019-05-08 21:23:07 -07:00
file.c f2fs: remove new blank line of f2fs kernel message 2019-05-08 21:23:08 -07:00
gc.c f2fs: fix to avoid deadloop in foreground GC 2019-05-08 21:23:06 -07:00
gc.h f2fs: add SPDX license identifiers 2018-09-12 13:07:10 -07:00
hash.c f2fs: add SPDX license identifiers 2018-09-12 13:07:10 -07:00
inline.c f2fs: fix to retrieve inline xattr space 2019-05-08 21:23:06 -07:00
inode.c f2fs: fix to do checksum even if inode page is uptodate 2019-05-08 21:23:08 -07:00
Kconfig fscrypt: remove filesystem specific build config option 2019-01-23 23:56:43 -05:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
namei.c f2fs-for-5.1-rc1 2019-03-15 13:42:53 -07:00
node.c f2fs: fix to do sanity check on free nid 2019-05-08 21:23:09 -07:00
node.h f2fs: check PageWriteback flag for ordered case 2018-12-26 15:16:56 -08:00
recovery.c f2fs: fix error path of recovery 2019-05-08 21:23:06 -07:00
segment.c f2fs: improve discard handling with multi-device volumes 2019-04-05 09:33:55 -07:00
segment.h f2fs: don't wake up too frequently, if there is lots of IOs 2019-02-15 20:59:45 -08:00
shrinker.c f2fs: fix sbi->extent_list corruption issue 2018-12-26 15:16:54 -08:00
super.c f2fs: remove new blank line of f2fs kernel message 2019-05-08 21:23:08 -07:00
sysfs.c f2fs-for-5.1-rc1 2019-03-15 13:42:53 -07:00
trace.c f2fs: do not use mutex lock in atomic context 2019-03-05 19:58:06 -08:00
trace.h f2fs: add SPDX license identifiers 2018-09-12 13:07:10 -07:00
xattr.c f2fs: fix to adapt small inline xattr space in __find_inline_xattr() 2019-03-12 19:02:26 -07:00
xattr.h f2fs: fix to do sanity check with inode.i_inline_xattr_size 2019-03-12 19:02:26 -07:00