• Jaegeuk Kim's avatar
    f2fs: handle errors of f2fs_get_meta_page_nofail · 86f33603
    Jaegeuk Kim authored
    First problem is we hit BUG_ON() in f2fs_get_sum_page given EIO on
    f2fs_get_meta_page_nofail().
    
    Quick fix was not to give any error with infinite loop, but syzbot caught
    a case where it goes to that loop from fuzzed image. In turned out we abused
    f2fs_get_meta_page_nofail() like in the below call stack.
    
    - f2fs_fill_super
     - f2fs_build_segment_manager
      - build_sit_entries
       - get_current_sit_page
    
    INFO: task syz-executor178:6870 can't die for more than 143 seconds.
    task:syz-executor178 state:R
     stack:26960 pid: 6870 ppid:  6869 flags:0x00004006
    Call Trace:
    
    Showing all locks held in the system:
    1 lock held by khungtaskd/1179:
     #0: ffffffff8a554da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6242
    1 lock held by systemd-journal/3920:
    1 lock held by in:imklog/6769:
     #0: ffff88809eebc130 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:930
    1 lock held by syz-executor178/6870:
     #0: ffff8880925120e0 (&type->s_umount_key#47/1){+.+.}-{3:3}, at: alloc_super+0x201/0xaf0 fs/super.c:229
    
    Actually, we didn't have to use _nofail in this case, since we could return
    error to mount(2) already with the error handler.
    
    As a result, this patch tries to 1) remove _nofail callers as much as possible,
    2) deal with error case in last remaining caller, f2fs_get_sum_page().
    
    Reported-by: syzbot+ee250ac8137be41d7b13@syzkaller.appspotmail.com
    Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    86f33603
segment.c 134 KB