• Chao Yu's avatar
    f2fs: fix to avoid panic in dec_valid_block_count() · 3f4a094e
    Chao Yu authored
    [ Upstream commit 5e159cd3 ]
    
    As Jungyeon reported in bugzilla:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=203209
    
    - Overview
    When mounting the attached crafted image and running program, I got this error.
    Additionally, it hangs on sync after the this script.
    
    The image is intentionally fuzzed from a normal f2fs image for testing and I enabled option CONFIG_F2FS_CHECK_FS on.
    
    - Reproduces
    cc poc_01.c
    ./run.sh f2fs
    sync
    
     kernel BUG at fs/f2fs/f2fs.h:1788!
     RIP: 0010:f2fs_truncate_data_blocks_range+0x342/0x350
     Call Trace:
      f2fs_truncate_blocks+0x36d/0x3c0
      f2fs_truncate+0x88/0x110
      f2fs_setattr+0x3e1/0x460
      notify_change+0x2da/0x400
      do_truncate+0x6d/0xb0
      do_sys_ftruncate+0xf1/0x160
      do_syscall_64+0x43/0xf0
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    The reason is dec_valid_block_count() will trigger kernel panic due to
    inconsistent count in between inode.i_blocks and actual block.
    
    To avoid panic, let's just print debug message and set SBI_NEED_FSCK to
    give a hint to fsck for latter repairing.
    Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
    [Jaegeuk Kim: fix build warning and add unlikely]
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    3f4a094e
f2fs.h 115 KB