linux-kernel - Re: [PATCH 4.19 034/118] f2fs: fix to avoid panic in f2fs_inplace_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 18 Jun 2019 15:01:36 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     Pavel Machek <pavel@....cz>
CC:     <linux-kernel@...r.kernel.org>, Jaegeuk Kim <jaegeuk@...nel.org>,
        "Sasha Levin" <sashal@...nel.org>
Subject: Re: [PATCH 4.19 034/118] f2fs: fix to avoid panic in
 f2fs_inplace_write_data()

Hi Pavel,

On 2019/6/17 3:54, Pavel Machek wrote:
> Hi!
> 
>> [ Upstream commit 05573d6ccf702df549a7bdeabef31e4753df1a90 ]
>>
>> As Jungyeon reported in bugzilla:
>>
>> https://bugzilla.kernel.org/show_bug.cgi?id=203239
>>
>> - Overview
>> When mounting the attached crafted image and running program, following errors are reported.
>> Additionally, it hangs on sync after running program.
>>
>> The image is intentionally fuzzed from a normal f2fs image for testing.
>> Compile options for F2FS are as follows.
>> CONFIG_F2FS_FS=y
> ...
>> The reason is f2fs_inplace_write_data() will trigger kernel panic due
>> to data block locates in node type segment.
>>
>> To avoid panic, let's just return error code and set SBI_NEED_FSCK to
>> give a hint to fsck for latter repairing.
> 
>> index 03fa2c4d3d79..8fc3edb6760c 100644
>> --- a/fs/f2fs/segment.c
>> +++ b/fs/f2fs/segment.c
>> @@ -3069,13 +3069,18 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
>>  {
>>  	int err;
>>  	struct f2fs_sb_info *sbi = fio->sbi;
>> +	unsigned int segno;
>>  
>>  	fio->new_blkaddr = fio->old_blkaddr;
>>  	/* i/o temperature is needed for passing down write hints */
>>  	__get_segment_type(fio);
>>  
>> -	f2fs_bug_on(sbi, !IS_DATASEG(get_seg_entry(sbi,
>> -			GET_SEGNO(sbi, fio->new_blkaddr))->type));
>> +	segno = GET_SEGNO(sbi, fio->new_blkaddr);
>> +
>> +	if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
>> +		set_sbi_flag(sbi, SBI_NEED_FSCK);
>> +		return -EFAULT;
>> +	}
>>  
> 
> Would it make sense to print some kind of debug message, as we do in
> the other error cases?

Although it's corner case, I think it will be better to do that, let me add it
in another patch.

Thanks for reminding. :)

Thanks,

> 
> Best regards,
> 									Pavel
>