1. 28 1月, 2021 2 次提交
  2. 25 1月, 2021 1 次提交
  3. 11 12月, 2020 2 次提交
    • C
      f2fs: compress: fix compression chksum · 75e91c88
      Chao Yu 提交于
      This patch addresses minor issues in compression chksum.
      
      Fixes: b28f047b ("f2fs: compress: support chksum")
      Signed-off-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      75e91c88
    • C
      f2fs: fix shift-out-of-bounds in sanity_check_raw_super() · e584bbe8
      Chao Yu 提交于
      syzbot reported a bug which could cause shift-out-of-bounds issue,
      fix it.
      
      Call Trace:
       __dump_stack lib/dump_stack.c:79 [inline]
       dump_stack+0x107/0x163 lib/dump_stack.c:120
       ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
       __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
       sanity_check_raw_super fs/f2fs/super.c:2812 [inline]
       read_raw_super_block fs/f2fs/super.c:3267 [inline]
       f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519
       mount_bdev+0x34d/0x410 fs/super.c:1366
       legacy_get_tree+0x105/0x220 fs/fs_context.c:592
       vfs_get_tree+0x89/0x2f0 fs/super.c:1496
       do_new_mount fs/namespace.c:2896 [inline]
       path_mount+0x12ae/0x1e70 fs/namespace.c:3227
       do_mount fs/namespace.c:3240 [inline]
       __do_sys_mount fs/namespace.c:3448 [inline]
       __se_sys_mount fs/namespace.c:3425 [inline]
       __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
       do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
      Signed-off-by: NAnant Thazhemadam <anant.thazhemadam@gmail.com>
      Signed-off-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      e584bbe8
  4. 09 12月, 2020 6 次提交
    • D
      f2fs: fix race of pending_pages in decompression · 6422a71e
      Daeho Jeong 提交于
      I found out f2fs_free_dic() is invoked in a wrong timing, but
      f2fs_verify_bio() still needed the dic info and it triggered the
      below kernel panic. It has been caused by the race condition of
      pending_pages value between decompression and verity logic, when
      the same compression cluster had been split in different bios.
      By split bios, f2fs_verify_bio() ended up with decreasing
      pending_pages value before it is reset to nr_cpages by
      f2fs_decompress_pages() and caused the kernel panic.
      
      [ 4416.564763] Unable to handle kernel NULL pointer dereference
                     at virtual address 0000000000000000
      ...
      [ 4416.896016] Workqueue: fsverity_read_queue f2fs_verity_work
      [ 4416.908515] pc : fsverity_verify_page+0x20/0x78
      [ 4416.913721] lr : f2fs_verify_bio+0x11c/0x29c
      [ 4416.913722] sp : ffffffc019533cd0
      [ 4416.913723] x29: ffffffc019533cd0 x28: 0000000000000402
      [ 4416.913724] x27: 0000000000000001 x26: 0000000000000100
      [ 4416.913726] x25: 0000000000000001 x24: 0000000000000004
      [ 4416.913727] x23: 0000000000001000 x22: 0000000000000000
      [ 4416.913728] x21: 0000000000000000 x20: ffffffff2076f9c0
      [ 4416.913729] x19: ffffffff2076f9c0 x18: ffffff8a32380c30
      [ 4416.913731] x17: ffffffc01f966d97 x16: 0000000000000298
      [ 4416.913732] x15: 0000000000000000 x14: 0000000000000000
      [ 4416.913733] x13: f074faec89ffffff x12: 0000000000000000
      [ 4416.913734] x11: 0000000000001000 x10: 0000000000001000
      [ 4416.929176] x9 : ffffffff20d1f5c7 x8 : 0000000000000000
      [ 4416.929178] x7 : 626d7464ff286b6b x6 : ffffffc019533ade
      [ 4416.929179] x5 : 000000008049000e x4 : ffffffff2793e9e0
      [ 4416.929180] x3 : 000000008049000e x2 : ffffff89ecfa74d0
      [ 4416.929181] x1 : 0000000000000c40 x0 : ffffffff2076f9c0
      [ 4416.929184] Call trace:
      [ 4416.929187]  fsverity_verify_page+0x20/0x78
      [ 4416.929189]  f2fs_verify_bio+0x11c/0x29c
      [ 4416.929192]  f2fs_verity_work+0x58/0x84
      [ 4417.050667]  process_one_work+0x270/0x47c
      [ 4417.055354]  worker_thread+0x27c/0x4d8
      [ 4417.059784]  kthread+0x13c/0x320
      [ 4417.063693]  ret_from_fork+0x10/0x18
      
      Chao pointed this can happen by the below race condition.
      
      Thread A        f2fs_post_read_wq          fsverity_wq
      - f2fs_read_multi_pages()
        - f2fs_alloc_dic
         - dic->pending_pages = 2
         - submit_bio()
         - submit_bio()
                     - f2fs_post_read_work() handle first bio
                      - f2fs_decompress_work()
                       - __read_end_io()
                        - f2fs_decompress_pages()
                         - dic->pending_pages--
                      - enqueue f2fs_verity_work()
                                                 - f2fs_verity_work() handle first bio
                                                  - f2fs_verify_bio()
                                                   - dic->pending_pages--
                     - f2fs_post_read_work() handle second bio
                      - f2fs_decompress_work()
                      - enqueue f2fs_verity_work()
                                                  - f2fs_verify_pages()
                                                  - f2fs_free_dic()
      
                                                - f2fs_verity_work() handle second bio
                                                 - f2fs_verfy_bio()
                                                       - use-after-free on dic
      Signed-off-by: NDaeho Jeong <daehojeong@google.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      6422a71e
    • C
      f2fs: fix to account inline xattr correctly during recovery · 96dd0251
      Chao Yu 提交于
      During recovery, we may missed to update inline xattr count correctly,
      fix it.
      Signed-off-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      96dd0251
    • J
      f2fs: inline: fix wrong inline inode stat · 84921561
      Jack Qiu 提交于
      Miss to stat inline inode in f2fs_recover_inline_data.
      Signed-off-by: NJack Qiu <jack.qiu@huawei.com>
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      84921561
    • J
      f2fs: inline: correct comment in f2fs_recover_inline_data · 6e5ca4fc
      Jack Qiu 提交于
      In 3rd scene, it should remove data blocks instead of inline_data.
      Signed-off-by: NJack Qiu <jack.qiu@huawei.com>
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      6e5ca4fc
    • Y
      f2fs: don't check PAGE_SIZE again in sanity_check_raw_super() · d540e35d
      Yangtao Li 提交于
      Many flash devices read and write a single IO based on a multiple
      of 4KB, and we support only 4KB page cache size now.
      
      Since we already check page size in init_f2fs_fs(), so remove page
      size check in sanity_check_raw_super().
      Signed-off-by: NYangtao Li <tiny.windzz@gmail.com>
      Signed-off-by: NShaohua Liu <liush@allwinnertech.com>
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      d540e35d
    • Y
      f2fs: convert to F2FS_*_INO macro · b9ec1094
      Yangtao Li 提交于
      Use F2FS_ROOT_INO, F2FS_NODE_INO and F2FS_META_INO macro
      for better code readability.
      Signed-off-by: NYangtao Li <tiny.windzz@gmail.com>
      Signed-off-by: NShaohua Liu <liush@allwinnertech.com>
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      b9ec1094
  5. 08 12月, 2020 2 次提交
    • J
      f2fs: introduce max_io_bytes, a sysfs entry, to limit bio size · 10208567
      Jaegeuk Kim 提交于
      This patch adds max_io_bytes to limit bio size when f2fs tries to merge
      consecutive IOs. This can give a testing point to split out bios and check
      end_io handles those bios correctly. This is used to capture a recent bug
      on the decompression and fsverity flow.
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      10208567
    • J
      f2fs: don't allow any writes on readonly mount · ec2ddf49
      Jaegeuk Kim 提交于
      generic_make_request: Trying to write to read-only block-device dm-5 (partno 0)
      WARNING: CPU: 7 PID: 546 at block/blk-core.c:2190 generic_make_request_checks+0x664/0x690
      pc : generic_make_request_checks+0x664/0x690
      lr : generic_make_request_checks+0x664/0x690
      Call trace:
       generic_make_request_checks+0x664/0x690
       generic_make_request+0xf0/0x3a4
       submit_bio+0x80/0x250
       __submit_merged_bio+0x368/0x4e0
       __submit_merged_write_cond.llvm.12294350193007536502+0xe0/0x3e8
       f2fs_wait_on_page_writeback+0x84/0x128
       f2fs_convert_inline_page+0x35c/0x6f8
       f2fs_convert_inline_inode+0xe0/0x2e0
       f2fs_file_mmap+0x48/0x9c
       mmap_region+0x41c/0x74c
       do_mmap+0x40c/0x4fc
       vm_mmap_pgoff+0xb8/0x114
       vm_mmap+0x34/0x48
       elf_map+0x68/0x108
       load_elf_binary+0x538/0xb70
       search_binary_handler+0xac/0x1dc
       exec_binprm+0x50/0x15c
       __do_execve_file+0x620/0x740
       __arm64_sys_execve+0x54/0x68
       el0_svc_common+0x9c/0x168
       el0_svc_handler+0x60/0x6c
       el0_svc+0x8/0xc
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NJaegeuk Kim <jaegeuk@kernel.org>
      ec2ddf49
  6. 03 12月, 2020 23 次提交
  7. 02 12月, 2020 4 次提交
反馈
建议
客服 返回
顶部