• C
    f2fs: fix to do sanity check on segment bitmap of LFS curseg · 303f6d6b
    Chao Yu 提交于
    [ Upstream commit c854f4d681365498f53ba07843a16423625aa7e9 ]
    
    As Jungyeon Reported in bugzilla:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=203233
    
    - Reproduces
    gcc poc_13.c
    ./run.sh f2fs
    
    - Kernel messages
     F2FS-fs (sdb): Bitmap was wrongly set, blk:4608
     kernel BUG at fs/f2fs/segment.c:2133!
     RIP: 0010:update_sit_entry+0x35d/0x3e0
     Call Trace:
      f2fs_allocate_data_block+0x16c/0x5a0
      do_write_page+0x57/0x100
      f2fs_do_write_node_page+0x33/0xa0
      __write_node_page+0x270/0x4e0
      f2fs_sync_node_pages+0x5df/0x670
      f2fs_write_checkpoint+0x364/0x13a0
      f2fs_sync_fs+0xa3/0x130
      f2fs_do_sync_file+0x1a6/0x810
      do_fsync+0x33/0x60
      __x64_sys_fsync+0xb/0x10
      do_syscall_64+0x43/0x110
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    The testcase fails because that, in fuzzed image, current segment was
    allocated with LFS type, its .next_blkoff should point to an unused
    block address, but actually, its bitmap shows it's not. So during
    allocation, f2fs crash when setting bitmap.
    
    Introducing sanity_check_curseg() to check such inconsistence of
    current in-used segment.
    Signed-off-by: NChao Yu <yuchao0@huawei.com>
    Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: NSasha Levin <sashal@kernel.org>
    303f6d6b
segment.c 110.4 KB