releases/4.4.172/f2fs-sanity-check-on-sit-entry.patch

   1 From foo@baz Fri Jan 18 09:16:11 CET 2019
   2 From: Jaegeuk Kim <jaegeuk@kernel.org>
   3 Date: Tue, 24 Apr 2018 15:44:16 -0600
   4 Subject: f2fs: sanity check on sit entry
   5
   6 From: Jaegeuk Kim <jaegeuk@kernel.org>
   7
   8 commit b2ca374f33bd33fd822eb871876e4888cf79dc97 upstream.
   9
  10 syzbot hit the following crash on upstream commit
  11 87ef12027b9b1dd0e0b12cf311fbcb19f9d92539 (Wed Apr 18 19:48:17 2018 +0000)
  12 Merge tag 'ceph-for-4.17-rc2' of git://github.com/ceph/ceph-client
  13 syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=83699adeb2d13579c31e
  14
  15 C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5805208181407744
  16 syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=6005073343676416
  17 Raw console output: https://syzkaller.appspot.com/x/log.txt?id=6555047731134464
  18 Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118
  19 compiler: gcc (GCC) 8.0.1 20180413 (experimental)
  20
  21 IMPORTANT: if you fix the bug, please add the following tag to the commit:
  22 Reported-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com
  23 It will help syzbot understand when the bug is fixed. See footer for details.
  24 If you forward the report, please keep this part and the footer.
  25
  26 F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
  27 F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
  28 F2FS-fs (loop0): invalid crc value
  29 BUG: unable to handle kernel paging request at ffffed006b2a50c0
  30 PGD 21ffee067 P4D 21ffee067 PUD 21fbeb067 PMD 0
  31 Oops: 0000 [#1] SMP KASAN
  32 Dumping ftrace buffer:
  33    (ftrace buffer empty)
  34 Modules linked in:
  35 CPU: 0 PID: 4514 Comm: syzkaller989480 Not tainted 4.17.0-rc1+ #8
  36 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  37 RIP: 0010:build_sit_entries fs/f2fs/segment.c:3653 [inline]
  38 RIP: 0010:build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852
  39 RSP: 0018:ffff8801b102e5b0 EFLAGS: 00010a06
  40 RAX: 1ffff1006b2a50c0 RBX: 0000000000000004 RCX: 0000000000000001
  41 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801ac74243e
  42 RBP: ffff8801b102f410 R08: ffff8801acbd46c0 R09: fffffbfff14d9af8
  43 R10: fffffbfff14d9af8 R11: ffff8801acbd46c0 R12: ffff8801ac742a80
  44 R13: ffff8801d9519100 R14: dffffc0000000000 R15: ffff880359528600
  45 FS:  0000000001e04880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
  46 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  47 CR2: ffffed006b2a50c0 CR3: 00000001ac6ac000 CR4: 00000000001406f0
  48 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  49 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  50 Call Trace:
  51  f2fs_fill_super+0x4095/0x7bf0 fs/f2fs/super.c:2803
  52  mount_bdev+0x30c/0x3e0 fs/super.c:1165
  53  f2fs_mount+0x34/0x40 fs/f2fs/super.c:3020
  54  mount_fs+0xae/0x328 fs/super.c:1268
  55  vfs_kern_mount.part.34+0xd4/0x4d0 fs/namespace.c:1037
  56  vfs_kern_mount fs/namespace.c:1027 [inline]
  57  do_new_mount fs/namespace.c:2517 [inline]
  58  do_mount+0x564/0x3070 fs/namespace.c:2847
  59  ksys_mount+0x12d/0x140 fs/namespace.c:3063
  60  __do_sys_mount fs/namespace.c:3077 [inline]
  61  __se_sys_mount fs/namespace.c:3074 [inline]
  62  __x64_sys_mount+0xbe/0x150 fs/namespace.c:3074
  63  do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
  64  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  65 RIP: 0033:0x443d6a
  66 RSP: 002b:00007ffd312813c8 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
  67 RAX: ffffffffffffffda RBX: 0000000020000c00 RCX: 0000000000443d6a
  68 RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd312813d0
  69 RBP: 0000000000000003 R08: 0000000020016a00 R09: 000000000000000a
  70 R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000004
  71 R13: 0000000000402c60 R14: 0000000000000000 R15: 0000000000000000
  72 RIP: build_sit_entries fs/f2fs/segment.c:3653 [inline] RSP: ffff8801b102e5b0
  73 RIP: build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852 RSP: ffff8801b102e5b0
  74 CR2: ffffed006b2a50c0
  75 ---[ end trace a2034989e196ff17 ]---
  76
  77 Reported-and-tested-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com
  78 Reviewed-by: Chao Yu <yuchao0@huawei.com>
  79 Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
  80 [bwh: Backported to 4.4: adjust context]
  81 Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
  82 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  83 ---
  84  fs/f2fs/segment.c |    9 +++++++++
  85  1 file changed, 9 insertions(+)
  86
  87 --- a/fs/f2fs/segment.c
  88 +++ b/fs/f2fs/segment.c
  89 @@ -2152,6 +2152,15 @@ static int build_sit_entries(struct f2fs
  90                 unsigned int old_valid_blocks;
  91
  92                 start = le32_to_cpu(segno_in_journal(sum, i));
  93 +               if (start >= MAIN_SEGS(sbi)) {
  94 +                       f2fs_msg(sbi->sb, KERN_ERR,
  95 +                                       "Wrong journal entry on segno %u",
  96 +                                       start);
  97 +                       set_sbi_flag(sbi, SBI_NEED_FSCK);
  98 +                       err = -EINVAL;
  99 +                       break;
 100 +               }
 101 +
 102                 se = &sit_i->sentries[start];
 103                 sit = sit_in_journal(sum, i);
 104