[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 5.15 009/846] f2fs: fix to do sanity check on inode type during garbage collection
    From: Chao Yu <>

    commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.

    As report by Wenqing Liu in bugzilla:

    - Overview
    kernel NULL pointer dereference triggered in folio_mark_dirty() when mount and operate on a crafted f2fs image

    - Reproduce
    tested on kernel 5.16-rc3, 5.15.X under root

    1. mkdir mnt
    2. mount -t f2fs tmp1.img mnt
    3. touch tmp
    4. cp tmp mnt

    F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
    F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
    BUG: kernel NULL pointer dereference, address: 0000000000000000
    move_data_page+0x2dd/0x460 [f2fs]
    do_garbage_collect+0xc18/0x16a0 [f2fs]
    f2fs_gc+0x1d3/0xd90 [f2fs]
    f2fs_balance_fs+0x13a/0x570 [f2fs]
    f2fs_create+0x285/0x840 [f2fs]

    The root cause is for special file: e.g. character, block, fifo or socket file,
    f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
    so, in a fuzzed image, SSA table indicates a data block belong to special file, when
    f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
    calls a_ops->set_dirty_page().

    Reported-by: Wenqing Liu <>
    Signed-off-by: Chao Yu <>
    Signed-off-by: Jaegeuk Kim <>
    Signed-off-by: Greg Kroah-Hartman <>
    fs/f2fs/gc.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/fs/f2fs/gc.c
    +++ b/fs/f2fs/gc.c
    @@ -1454,7 +1454,8 @@ next_step:

    if (phase == 3) {
    inode = f2fs_iget(sb, dni.ino);
    - if (IS_ERR(inode) || is_bad_inode(inode))
    + if (IS_ERR(inode) || is_bad_inode(inode) ||
    + special_file(inode->i_mode))

    if (!down_write_trylock(

     \ /
      Last update: 2022-01-25 04:40    [W:3.046 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site