Chao Yu
229b2b992b
f2fs: fix to do sanity check on curseg->alloc_type
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215657
- Overview
UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image
- Reproduce
tested on kernel 5.17-rc4, 5.17-rc6
1. mkdir test_crash
2. cd test_crash
3. unzip tmp2.zip
4. mkdir mnt
5. ./single_test.sh f2fs 2
- Kernel dump
[ 46.434454] loop0: detected capacity change from 0 to 131072
[ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9
[ 46.738319] ================================================================================
[ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2
[ 46.738475] index 231 is out of range for type 'unsigned int [2]'
[ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1
[ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[ 46.738551] Call Trace:
[ 46.738556] <TASK>
[ 46.738563] dump_stack_lvl+0x47/0x5c
[ 46.738581] ubsan_epilogue+0x5/0x50
[ 46.738592] __ubsan_handle_out_of_bounds+0x68/0x80
[ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs]
[ 46.738819] do_write_page+0xef/0x210 [f2fs]
[ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs]
[ 46.739038] __write_node_page+0x2b7/0x920 [f2fs]
[ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs]
[ 46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs]
[ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs]
[ 46.739507] deactivate_locked_super+0x60/0xc0
[ 46.739517] deactivate_super+0x70/0xb0
[ 46.739524] cleanup_mnt+0x11a/0x200
[ 46.739532] __cleanup_mnt+0x16/0x20
[ 46.739538] task_work_run+0x67/0xa0
[ 46.739547] exit_to_user_mode_prepare+0x18c/0x1a0
[ 46.739559] syscall_exit_to_user_mode+0x26/0x40
[ 46.739568] do_syscall_64+0x46/0xb0
[ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is we missed to do sanity check on curseg->alloc_type,
result in out-of-bound accessing on sbi->block_count[] array, fix it.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-03-03 18:23:29 -08:00
..
2021-10-04 22:07:46 +01:00
2021-06-29 10:53:48 -07:00
2021-06-29 10:53:48 -07:00
2021-10-07 11:20:08 -07:00
2021-10-20 21:09:02 -04:00
2021-08-19 09:02:55 +09:00
2021-06-29 10:53:48 -07:00
2021-12-06 10:51:33 -08:00
2021-08-27 13:34:02 +01:00
2021-10-19 09:36:06 +02:00
2021-09-23 21:12:53 -05:00
2021-04-23 14:42:39 -07:00
2021-08-25 07:58:49 +02:00
2021-11-16 13:58:03 -08:00
2021-09-21 09:09:06 +02:00
2021-09-01 11:29:14 -05:00
2021-06-29 10:53:48 -07:00
2021-04-12 15:04:29 +02:00
2021-12-06 10:51:33 -08:00
2021-07-06 11:06:04 -07:00
2021-09-22 13:05:23 +02:00
2021-12-06 10:51:33 -08:00
2022-03-03 18:23:29 -08:00
2021-09-02 12:32:12 -07:00
2021-10-04 22:13:12 +01:00
2021-10-21 10:01:39 +02:00
2021-12-06 10:51:33 -08:00
2021-07-15 10:13:49 -07:00
2021-07-01 11:06:06 -07:00
2021-08-26 22:28:02 +02:00
2021-07-27 11:00:36 +02:00
2021-07-23 17:43:28 -07:00
2021-12-06 10:51:33 -08:00
2021-11-12 15:05:50 +01:00
2021-08-30 23:36:50 -04:00
2021-08-18 22:08:24 +02:00
2021-08-18 22:08:24 +02:00
2021-10-04 10:27:18 +02:00
2021-10-20 00:07:10 -05:00
2021-09-22 09:21:02 -07:00
2021-06-29 10:53:48 -07:00
2021-10-05 11:22:06 +01:00
2021-09-04 10:25:26 -07:00
2021-10-04 22:02:17 +01:00
2021-10-07 14:11:40 -07:00
2021-09-08 12:55:35 -07:00
2021-09-10 09:46:48 -07:00
2021-07-03 11:30:04 -07:00
2021-10-15 09:58:11 -04:00
2021-10-28 17:18:55 -07:00
2021-06-29 10:53:48 -07:00
2021-08-18 22:08:24 +02:00
2021-09-28 09:16:12 +02:00
2021-11-12 15:05:48 +01:00
2021-06-30 12:21:16 -07:00
2021-09-21 08:36:48 -07:00
2021-06-22 10:40:52 +02:00
2021-06-29 10:53:48 -07:00
2021-09-03 15:33:47 -07:00
2021-09-13 14:51:10 -05:00
2021-08-16 10:50:32 -06:00
2021-08-06 13:05:28 +02:00
2021-06-29 10:53:48 -07:00
2021-03-23 14:08:18 -04:00
2021-11-16 13:58:02 -08:00
2021-08-23 13:35:19 +02:00
2021-08-19 09:02:55 +09:00
2021-05-02 00:43:35 +09:00
2021-09-27 11:26:21 -07:00
2021-09-22 10:56:34 -07:00
2021-12-06 10:51:33 -08:00
2021-12-06 10:51:33 -08:00
2021-08-28 01:33:02 +02:00
2022-02-15 13:42:55 -08:00
2021-08-18 22:08:24 +02:00
2021-09-05 10:15:05 -07:00
2021-09-03 18:42:01 +02:00
2021-10-03 14:02:58 -07:00
2021-06-29 10:53:50 -07:00
2021-09-24 16:13:35 -07:00
2021-09-08 11:50:27 -07:00
2021-09-02 10:07:29 -07:00
2021-08-31 11:13:35 -07:00
2021-04-15 22:36:45 -04:00
2021-04-09 14:54:23 -07:00
2021-09-03 09:58:10 -07:00
2021-09-06 07:20:56 -04:00
2021-09-09 13:25:49 -07:00
2021-09-04 11:35:47 -07:00
2021-09-03 10:08:28 -07:00
2021-04-07 13:56:43 -04:00
2021-09-11 14:48:42 -07:00
2021-08-23 01:25:40 -04:00
2021-09-03 09:58:12 -07:00
2021-09-07 16:07:47 -04:00
2021-09-03 10:08:28 -07:00
2021-09-17 13:39:23 +02:00
2021-09-07 08:39:40 -06:00
2021-10-21 11:19:38 -06:00
2021-10-19 17:09:34 -06:00
2021-08-29 07:55:55 -06:00
2021-08-31 11:06:32 -07:00
2021-09-12 10:10:21 -07:00
2021-07-25 22:33:03 -07:00
2021-10-18 20:22:03 -10:00
2021-06-29 10:53:48 -07:00
2021-09-07 11:21:48 -07:00
2021-09-12 10:10:21 -07:00
2021-09-07 16:14:05 -04:00
2021-09-03 10:08:28 -07:00
2021-08-23 06:15:36 -04:00
2021-09-07 11:03:45 -07:00
2021-08-18 22:08:24 +02:00
2021-08-24 07:52:45 -04:00
2021-04-17 11:39:49 -07:00
2021-08-23 06:15:36 -04:00
2021-09-07 11:26:23 -07:00
2021-07-19 17:18:48 -07:00
2021-07-23 13:16:43 -05:00
2021-08-17 11:47:43 +02:00
2021-08-09 11:53:26 -06:00
2021-08-10 17:57:22 +02:00
2021-10-18 20:22:02 -10:00
2021-03-23 11:20:26 +01:00