linux-kernel - Re: [PATCH 4.19 034/118] f2fs: fix to avoid panic in f2fs_inplace_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190616195430.GC6676@amd>
Date:   Sun, 16 Jun 2019 21:54:30 +0200
From:   Pavel Machek <pavel@....cz>
To:     pavel@....cz
Cc:     linux-kernel@...r.kernel.org, Chao Yu <yuchao0@...wei.com>,
        Jaegeuk Kim <jaegeuk@...nel.org>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.19 034/118] f2fs: fix to avoid panic in
 f2fs_inplace_write_data()

Hi!

> [ Upstream commit 05573d6ccf702df549a7bdeabef31e4753df1a90 ]
> 
> As Jungyeon reported in bugzilla:
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=203239
> 
> - Overview
> When mounting the attached crafted image and running program, following errors are reported.
> Additionally, it hangs on sync after running program.
> 
> The image is intentionally fuzzed from a normal f2fs image for testing.
> Compile options for F2FS are as follows.
> CONFIG_F2FS_FS=y
...
> The reason is f2fs_inplace_write_data() will trigger kernel panic due
> to data block locates in node type segment.
> 
> To avoid panic, let's just return error code and set SBI_NEED_FSCK to
> give a hint to fsck for latter repairing.

> index 03fa2c4d3d79..8fc3edb6760c 100644
> --- a/fs/f2fs/segment.c
> +++ b/fs/f2fs/segment.c
> @@ -3069,13 +3069,18 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
>  {
>  	int err;
>  	struct f2fs_sb_info *sbi = fio->sbi;
> +	unsigned int segno;
>  
>  	fio->new_blkaddr = fio->old_blkaddr;
>  	/* i/o temperature is needed for passing down write hints */
>  	__get_segment_type(fio);
>  
> -	f2fs_bug_on(sbi, !IS_DATASEG(get_seg_entry(sbi,
> -			GET_SEGNO(sbi, fio->new_blkaddr))->type));
> +	segno = GET_SEGNO(sbi, fio->new_blkaddr);
> +
> +	if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
> +		set_sbi_flag(sbi, SBI_NEED_FSCK);
> +		return -EFAULT;
> +	}
>  

Would it make sense to print some kind of debug message, as we do in
the other error cases?

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)