linux-kernel - [PATCH] f2fs: Return the errno to the caller to avoid using a wrong page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 May 2016 12:31:19 +0800
From:	Yunlong Song <yunlong.song@...wei.com>
To:	<jaegeuk@...nel.org>, <cm224.lee@...sung.com>,
	<yuchao0@...wei.com>, <chao@...nel.org>, <sylinux@....com>,
	<yunlong.song@...wei.com>
CC:	<bintian.wang@...wei.com>, <houpengyang@...wei.com>,
	<heyunlei@...wei.com>, <liushuoran@...wei.com>,
	<shiguojun@...wei.com>, <linux-f2fs-devel@...ts.sourceforge.net>,
	<linux-kernel@...r.kernel.org>
Subject: [PATCH] f2fs: Return the errno to the caller to avoid using a wrong page

Commit aaf9607516ed38825268515ef4d773289a44f429 ("f2fs: check node page
contents all the time") pointed out that "sometimes it was reported that
its contents was missing", so it checks the page's mapping and contents.
When "nid != nid_of_node(page)", ERR_PTR(-EIO) will be returned to the
caller. However, commit e1c51b9f1df2f9efc2ec11488717e40cd12015f9 ("f2fs:
clean up node page updating flow") moves "nid != nid_of_node(page)" test
to "f2fs_bug_on(sbi, nid != nid_of_node(page))", this will return a
wrong page to the caller when F2FS_CHECK_FS is off when "sometimes it
was reported that its contents was missing" happens.

This patch restores to check node page contents all the time, and
returns the errno to make the caller known something is wrong and avoid
to use the page. This patch also moves f2fs_bug_on to its proper location.

Signed-off-by: Yunlong Song <yunlong.song@...wei.com>
---
 fs/f2fs/node.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 1f21aae..eee56aa 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1149,16 +1149,21 @@ repeat:

 	lock_page(page);

-	if (unlikely(!PageUptodate(page))) {
-		f2fs_put_page(page, 1);
-		return ERR_PTR(-EIO);
-	}
+	if (unlikely(!PageUptodate(page)))
+		goto out_err;
+
 	if (unlikely(page->mapping != NODE_MAPPING(sbi))) {
 		f2fs_put_page(page, 1);
 		goto repeat;
 	}
 page_hit:
-	f2fs_bug_on(sbi, nid != nid_of_node(page));
+	if(nid != nid_of_node(page)) {
+		f2fs_bug_on(sbi, 1);
+		ClearPageUptodate(page);
+out_err:
+		f2fs_put_page(page, 1);
+		return ERR_PTR(-EIO);
+	}
 	return page;
 }

-- 
1.8.5.2