• Chao Yu's avatar
    f2fs: fix to avoid panic in f2fs_remove_inode_page() · 54916125
    Chao Yu authored
    [ Upstream commit 8b6810f8 ]
    
    As Jungyeon reported in bugzilla:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=203219
    
    - Overview
    When mounting the attached crafted image and running program, I got this error.
    Additionally, it hangs on sync after running the program.
    
    The image is intentionally fuzzed from a normal f2fs image for testing and I enabled option CONFIG_F2FS_CHECK_FS on.
    
    - Reproduces
    cc poc_06.c
    mkdir test
    mount -t f2fs tmp.img test
    cp a.out test
    cd test
    sudo ./a.out
    sync
    
    - Messages
     kernel BUG at fs/f2fs/node.c:1183!
     RIP: 0010:f2fs_remove_inode_page+0x294/0x2d0
     Call Trace:
      f2fs_evict_inode+0x2a3/0x3a0
      evict+0xba/0x180
      __dentry_kill+0xbe/0x160
      dentry_kill+0x46/0x180
      dput+0xbb/0x100
      do_renameat2+0x3c9/0x550
      __x64_sys_rename+0x17/0x20
      do_syscall_64+0x43/0xf0
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    The reason is f2fs_remove_inode_page() will trigger kernel panic due to
    inconsistent i_blocks value of inode.
    
    To avoid panic, let's just print debug message and set SBI_NEED_FSCK to
    give a hint to fsck for latter repairing of potential image corruption.
    Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
    [Jaegeuk Kim: fix build warning and add unlikely]
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    54916125
node.c 75 KB