• Chao Yu's avatar
    f2fs: fix to avoid panic in dec_valid_node_count() · 076d876b
    Chao Yu authored
    [ Upstream commit ea6d7e72 ]
    
    As Jungyeon reported in bugzilla:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=203213
    
    - Overview
    When mounting the attached crafted image and running program, I got this error.
    Additionally, it hangs on sync after running the this script.
    
    The image is intentionally fuzzed from a normal f2fs image for testing and I enabled option CONFIG_F2FS_CHECK_FS on.
    
    - Reproduces
    mkdir test
    mount -t f2fs tmp.img test
    cp a.out test
    cd test
    sudo ./a.out
    sync
    
     kernel BUG at fs/f2fs/f2fs.h:2012!
     RIP: 0010:truncate_node+0x2c9/0x2e0
     Call Trace:
      f2fs_truncate_xattr_node+0xa1/0x130
      f2fs_remove_inode_page+0x82/0x2d0
      f2fs_evict_inode+0x2a3/0x3a0
      evict+0xba/0x180
      __dentry_kill+0xbe/0x160
      dentry_kill+0x46/0x180
      dput+0xbb/0x100
      do_renameat2+0x3c9/0x550
      __x64_sys_rename+0x17/0x20
      do_syscall_64+0x43/0xf0
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    The reason is dec_valid_node_count() will trigger kernel panic due to
    inconsistent count in between inode.i_blocks and actual block.
    
    To avoid panic, let's just print debug message and set SBI_NEED_FSCK to
    give a hint to fsck for latter repairing.
    Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
    [Jaegeuk Kim: fix build warning and add unlikely]
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    076d876b
f2fs.h 115 KB