5e159cd349
As Jungyeon reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203209 - Overview When mounting the attached crafted image and running program, I got this error. Additionally, it hangs on sync after the this script. The image is intentionally fuzzed from a normal f2fs image for testing and I enabled option CONFIG_F2FS_CHECK_FS on. - Reproduces cc poc_01.c ./run.sh f2fs sync kernel BUG at fs/f2fs/f2fs.h:1788! RIP: 0010:f2fs_truncate_data_blocks_range+0x342/0x350 Call Trace: f2fs_truncate_blocks+0x36d/0x3c0 f2fs_truncate+0x88/0x110 f2fs_setattr+0x3e1/0x460 notify_change+0x2da/0x400 do_truncate+0x6d/0xb0 do_sys_ftruncate+0xf1/0x160 do_syscall_64+0x43/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The reason is dec_valid_block_count() will trigger kernel panic due to inconsistent count in between inode.i_blocks and actual block. To avoid panic, let's just print debug message and set SBI_NEED_FSCK to give a hint to fsck for latter repairing. Signed-off-by: Chao Yu <yuchao0@huawei.com> [Jaegeuk Kim: fix build warning and add unlikely] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> |
||
---|---|---|
.. | ||
acl.c | ||
acl.h | ||
checkpoint.c | ||
data.c | ||
debug.c | ||
dir.c | ||
extent_cache.c | ||
f2fs.h | ||
file.c | ||
gc.c | ||
gc.h | ||
hash.c | ||
inline.c | ||
inode.c | ||
Kconfig | ||
Makefile | ||
namei.c | ||
node.c | ||
node.h | ||
recovery.c | ||
segment.c | ||
segment.h | ||
shrinker.c | ||
super.c | ||
sysfs.c | ||
trace.c | ||
trace.h | ||
xattr.c | ||
xattr.h |