Jaegeuk Kim 26bf4e8a96 f2fs: sanity check for total valid node blocks ... This patch enhances sanity check for SIT entries. syzbot hit the following crash on upstream commit 83beed7b2b (Fri Apr 20 17:56:32 2018 +0000) Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=bf9253040425feb155ad syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5692130282438656 Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5095924598571008 Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118 compiler: gcc (GCC) 8.0.1 20180413 (experimental) IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+bf9253040425feb155ad@syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer. F2FS-fs (loop0): invalid crc value F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 F2FS-fs (loop0): Mounted with checkpoint version = d F2FS-fs (loop0): Bitmap was wrongly cleared, blk:9740 ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:1884! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 4508 Comm: syz-executor0 Not tainted 4.17.0-rc1+ #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882 RSP: 0018:ffff8801af526708 EFLAGS: 00010282 RAX: ffffed0035ea4cc0 RBX: ffff8801ad454f90 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff82eeb87e RDI: ffffed0035ea4cb6 RBP: ffff8801af526760 R08: ffff8801ad4a2480 R09: ffffed003b5e4f90 R10: ffffed003b5e4f90 R11: ffff8801daf27c87 R12: ffff8801adb8d380 R13: 0000000000000001 R14: 0000000000000008 R15: 00000000ffffffff FS: 00000000014af940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f06bc223000 CR3: 00000001adb02000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: allocate_data_block+0x66f/0x2050 fs/f2fs/segment.c:2663 do_write_page+0x105/0x1b0 fs/f2fs/segment.c:2727 write_node_page+0x129/0x350 fs/f2fs/segment.c:2770 __write_node_page+0x7da/0x1370 fs/f2fs/node.c:1398 sync_node_pages+0x18cf/0x1eb0 fs/f2fs/node.c:1652 block_operations+0x429/0xa60 fs/f2fs/checkpoint.c:1088 write_checkpoint+0x3ba/0x5380 fs/f2fs/checkpoint.c:1405 f2fs_sync_fs+0x2fb/0x6a0 fs/f2fs/super.c:1077 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem+0x265/0x310 fs/sync.c:67 generic_shutdown_super+0xd7/0x520 fs/super.c:429 kill_block_super+0xa4/0x100 fs/super.c:1191 kill_f2fs_super+0x9f/0xd0 fs/f2fs/super.c:3030 deactivate_locked_super+0x97/0x100 fs/super.c:316 deactivate_super+0x188/0x1b0 fs/super.c:347 cleanup_mnt+0xbf/0x160 fs/namespace.c:1174 __cleanup_mnt+0x16/0x20 fs/namespace.c:1181 task_work_run+0x1e4/0x290 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x2bd/0x310 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:265 [inline] do_syscall_64+0x6ac/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457d97 RSP: 002b:00007ffd46f9c8e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000457d97 RDX: 00000000014b09a3 RSI: 0000000000000002 RDI: 00007ffd46f9da50 RBP: 00007ffd46f9da50 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000005 R11: 0000000000000246 R12: 00000000014b0940 R13: 0000000000000000 R14: 0000000000000002 R15: 000000000000658e RIP: update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882 RSP: ffff8801af526708 ---[ end trace f498328bb02610a2 ]--- Reported-and-tested-by: syzbot+bf9253040425feb155ad@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+7d6d31d3bc702f566ce3@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+0a725420475916460f12@syzkaller.appspotmail.com Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>		2018-07-08 17:28:57 -07:00
..
9p	9p: use file_dentry()	2016-08-10 11:49:27 +02:00
adfs
affs	affs: fix remount failure when there are no options changed	2016-06-07 18:14:32 -07:00
afs
autofs4	autofs: use dentry flags to block walks during expire	2016-09-30 10:18:37 +02:00
befs
bfs
btrfs	btrfs: ensure that file descriptor used with subvol ioctls is a dir	2016-09-30 10:18:38 +02:00
cachefiles
ceph	ceph: fix race during filling readdir cache	2016-10-07 15:23:42 +02:00
cifs	CIFS: Fix a possible invalid memory access in smb2_query_symlink()	2016-08-20 18:09:20 +02:00
coda
configfs
cramfs
crypto	fscrypt: log the crypto algorithm implementations	2018-06-28 14:24:29 -07:00
debugfs
devpts	devpts: clean up interface to pty drivers	2016-08-16 09:30:49 +02:00
dlm
ecryptfs	ecryptfs: fix handling of directory opening	2016-09-15 08:27:47 +02:00
efivarfs
efs
exofs
exportfs
ext2
ext4	fscrypt: resolve some cherry-pick bugs	2018-01-09 16:59:15 -08:00
f2fs	f2fs: sanity check for total valid node blocks	2018-07-08 17:28:57 -07:00
fat
freevxfs
fscache
fuse	fuse: direct-io: don't dirty ITER_BVEC pages	2016-09-24 10:07:41 +02:00
gfs2
hfs
hfsplus
hostfs	hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()	2016-09-30 10:18:39 +02:00
hpfs	hpfs: implement the show_options method	2016-06-01 12:15:54 -07:00
hugetlbfs
isofs	get_rock_ridge_filename(): handle malformed NM entries	2016-05-18 17:06:54 -07:00
jbd2	jbd2: make journal y2038 safe	2016-08-20 18:09:20 +02:00
jffs2
jfs
kernfs	kernfs: don't depend on d_find_any_alias() when generating notifications	2016-09-24 10:07:36 +02:00
lockd
logfs
minix
ncpfs
nfs	pNFS/flexfiles: Fix layoutcommit after a commit to DS	2016-10-07 15:23:45 +02:00
nfs_common
nfsd	nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock	2016-09-24 10:07:36 +02:00
nilfs2	fs/nilfs2: fix potential underflow in call to crc32_le	2016-08-10 11:49:25 +02:00
nls
notify	fanotify: fix list corruption in fanotify_get_response()	2016-09-30 10:18:37 +02:00
ntfs
ocfs2	ocfs2: fix start offset to ocfs2_zero_range_for_truncate()	2016-09-30 10:18:34 +02:00
omfs
openpromfs
overlayfs	ovl: fix workdir creation	2016-09-15 08:27:52 +02:00
proc	mm: introduce get_task_exe_file	2016-09-24 10:07:36 +02:00
pstore	pstore: drop file opened reference count	2016-10-07 15:23:44 +02:00
qnx4
qnx6
quota
ramfs
reiserfs	reiserfs: fix "new_insert_key may be used uninitialized ..."	2016-09-30 10:18:34 +02:00
romfs
squashfs
sysfs	sysfs: correctly handle read offset on PREALLOC attrs	2016-09-07 08:32:46 +02:00
sysv
tracefs
ubifs	ubifs: Fix assertion in layout_in_gaps()	2016-09-15 08:27:53 +02:00
udf
ufs
xfs	xfs: prevent dropping ioend completions during buftarg wait	2016-09-30 10:18:37 +02:00
aio.c	aio: mark AIO pseudo-fs noexec	2016-10-07 15:23:47 +02:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c
dax.c
dcache.c	fs/dcache.c: avoid soft-lockup in dput()	2016-08-16 09:30:50 +02:00
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c
exec.c
fcntl.c
fhandle.c
file_table.c
file.c
filesystems.c
fs_pin.c
fs_struct.c
fs-writeback.c
inode.c	vfs: fix deadlock in file_remove_privs() on overlayfs	2016-08-10 11:49:30 +02:00
internal.h
ioctl.c
Kconfig	f2fs: backport from (4c1fad64 - Merge tag 'for-f2fs-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs)	2016-10-17 16:38:44 -07:00
Kconfig.binfmt
libfs.c
locks.c	locks: use file_inode()	2016-08-10 11:49:27 +02:00
Makefile	f2fs: backport from (4c1fad64 - Merge tag 'for-f2fs-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs)	2016-10-17 16:38:44 -07:00
mbcache.c
mount.h
mpage.c
namei.c	fs: Check for invalid i_uid in may_follow_link()	2016-09-15 08:27:49 +02:00
namespace.c	namespace: update event counter when umounting a deleted dentry	2016-08-10 11:49:27 +02:00
no-block.c
nsfs.c
open.c	vfs: add vfs_select_inode() helper	2016-05-18 17:06:48 -07:00
pipe.c	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
pnode.c	propogate_mnt: Handle the first propogated copy being a slave	2016-05-11 11:21:19 +02:00
pnode.h
posix_acl.c	posix_acl: Clear SGID bit when setting file permissions	2016-11-22 14:06:03 -08:00
proc_namespace.c
read_write.c
readdir.c
select.c
seq_file.c	fs/seq_file: fix out-of-bounds read	2016-09-07 08:32:43 +02:00
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c	fs/super.c: fix race between freeze_super() and thaw_super()	2016-12-09 13:52:06 -08:00
sync.c
timerfd.c
userfaultfd.c
utimes.c
xattr.c