• Chao Yu's avatar
    f2fs: fix to do sanity check on .cp_pack_total_block_count · 5b5b4f85
    Chao Yu authored
    As bughunter reported in bugzilla:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=215709
    
    f2fs may hang when mounting a fuzzed image, the dmesg shows as below:
    
    __filemap_get_folio+0x3a9/0x590
    pagecache_get_page+0x18/0x60
    __get_meta_page+0x95/0x460 [f2fs]
    get_checkpoint_version+0x2a/0x1e0 [f2fs]
    validate_checkpoint+0x8e/0x2a0 [f2fs]
    f2fs_get_valid_checkpoint+0xd0/0x620 [f2fs]
    f2fs_fill_super+0xc01/0x1d40 [f2fs]
    mount_bdev+0x18a/0x1c0
    f2fs_mount+0x15/0x20 [f2fs]
    legacy_get_tree+0x28/0x50
    vfs_get_tree+0x27/0xc0
    path_mount+0x480/0xaa0
    do_mount+0x7c/0xa0
    __x64_sys_mount+0x8b/0xe0
    do_syscall_64+0x38/0xc0
    entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    The root cause is cp_pack_total_block_count field in checkpoint was fuzzed
    to one, as calcuated, two cp pack block locates in the same block address,
    so then read latter cp pack block, it will block on the page lock due to
    the lock has already held when reading previous cp pack block, fix it by
    adding sanity check for cp_pack_total_block_count.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarChao Yu <chao.yu@oppo.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    5b5b4f85
checkpoint.c 47.2 KB