Chao Yu 9aa4602237 f2fs: fix to avoid out-of-bounds memory access ... commit b862676e371715456c9dade7990c8004996d0d9e upstream. butt3rflyh4ck <butterflyhuangxx@gmail.com> reported a bug found by syzkaller fuzzer with custom modifications in 5.12.0-rc3+ [1]: dump_stack+0xfa/0x151 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x82/0x32c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 f2fs_test_bit fs/f2fs/f2fs.h:2572 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] get_next_nat_page fs/f2fs/node.c:123 [inline] __flush_nat_entry_set fs/f2fs/node.c:2888 [inline] f2fs_flush_nat_entries+0x258e/0x2960 fs/f2fs/node.c:2991 f2fs_write_checkpoint+0x1372/0x6a70 fs/f2fs/checkpoint.c:1640 f2fs_issue_checkpoint+0x149/0x410 fs/f2fs/checkpoint.c:1807 f2fs_sync_fs+0x20f/0x420 fs/f2fs/super.c:1454 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem fs/sync.c:67 [inline] sync_filesystem+0x1b5/0x260 fs/sync.c:48 generic_shutdown_super+0x70/0x370 fs/super.c:448 kill_block_super+0x97/0xf0 fs/super.c:1394 The root cause is, if nat entry in checkpoint journal area is corrupted, e.g. nid of journalled nat entry exceeds max nid value, during checkpoint, once it tries to flush nat journal to NAT area, get_next_nat_page() may access out-of-bounds memory on nat_bitmap due to it uses wrong nid value as bitmap offset. [1] https://lore.kernel.org/lkml/CAFcO6XOMWdr8pObek6eN6-fs58KG9doRFadgJj-FnF-1x43s2g@mail.gmail.com/T/#u Reported-and-tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-11 14:47:34 +02:00
..
acl.c	f2fs: clean up kvfree	2020-09-14 11:15:37 -07:00
acl.h
checkpoint.c	f2fs: avoid race condition for shrinker count	2021-01-06 14:56:54 +01:00
compress.c	f2fs: compress: fix potential deadlock	2021-03-04 11:37:44 +01:00
data.c	f2fs: fix a wrong condition in __submit_bio	2021-03-04 11:37:46 +01:00
debug.c	f2fs: avoid race condition for shrinker count	2021-01-06 14:56:54 +01:00
dir.c	f2fs-for-5.10-rc1	2020-10-16 15:14:43 -07:00
extent_cache.c	f2fs: support 64-bits key in f2fs rb-tree node entry	2020-09-10 14:03:30 -07:00
f2fs.h	f2fs: compress: fix potential deadlock	2021-03-04 11:37:44 +01:00
file.c	f2fs: enforce the immutable flag on open files	2021-03-04 11:38:43 +01:00
gc.c	f2fs: clean up kvfree	2020-09-14 11:15:37 -07:00
gc.h	f2fs: support age threshold based garbage collection	2020-09-11 11:11:15 -07:00
hash.c	f2fs-for-5.8-rc1	2020-06-09 11:28:59 -07:00
inline.c	f2fs: fix to avoid inconsistent quota data	2021-03-04 11:37:46 +01:00
inode.c	f2fs: fix to set SBI_NEED_FSCK flag for inconsistent inode	2020-10-09 10:29:31 -07:00
Kconfig
Makefile
namei.c	f2fs: fix to set/clear I_LINKABLE under i_lock	2021-03-07 12:34:12 +01:00
node.c	f2fs: fix to avoid out-of-bounds memory access	2021-05-11 14:47:34 +02:00
node.h	f2fs: avoid race condition for shrinker count	2021-01-06 14:56:54 +01:00
recovery.c	f2fs: fix error path in do_recover_data()	2020-07-08 10:11:19 -07:00
segment.c	f2fs: init dirty_secmap incorrectly	2020-12-26 16:02:42 +01:00
segment.h	f2fs: handle unallocated section and zone on pinned/atgc	2021-03-07 12:34:12 +01:00
shrinker.c	f2fs: avoid race condition for shrinker count	2021-01-06 14:56:54 +01:00
super.c	f2fs: flush data when enabling checkpoint back	2021-03-04 11:38:43 +01:00
sysfs.c	f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info	2020-10-14 13:23:30 -07:00
trace.c
trace.h
verity.c	f2fs: fix error handling in f2fs_end_enable_verity()	2021-05-11 14:47:34 +02:00
xattr.c	f2fs: clean up kvfree	2020-09-14 11:15:37 -07:00
xattr.h