This is a note to let you know that I've just added the patch titled f2fs: fix to do sanity check on block address in f2fs_do_zero_range() to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: f2fs-fix-to-do-sanity-check-on-block-address-in-f2fs_do_zero_range.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 25f8236213a91efdf708b9d77e9e51b6fc3e141c Mon Sep 17 00:00:00 2001 From: Chao Yu <chao@xxxxxxxxxx> Date: Wed, 27 Apr 2022 17:51:40 +0800 Subject: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() From: Chao Yu <chao@xxxxxxxxxx> commit 25f8236213a91efdf708b9d77e9e51b6fc3e141c upstream. As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT table with it. Cc: stable@xxxxxxxxxxxxxxx Reported-by: Ming Yan <yanming@xxxxxxxxxx> Signed-off-by: Chao Yu <chao.yu@xxxxxxxx> Signed-off-by: Jaegeuk Kim <jaegeuk@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/f2fs/file.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -1437,11 +1437,19 @@ static int f2fs_do_zero_range(struct dno ret = -ENOSPC; break; } - if (dn->data_blkaddr != NEW_ADDR) { - f2fs_invalidate_blocks(sbi, dn->data_blkaddr); - dn->data_blkaddr = NEW_ADDR; - f2fs_set_data_blkaddr(dn); + + if (dn->data_blkaddr == NEW_ADDR) + continue; + + if (!f2fs_is_valid_blkaddr(sbi, dn->data_blkaddr, + DATA_GENERIC_ENHANCE)) { + ret = -EFSCORRUPTED; + break; } + + f2fs_invalidate_blocks(sbi, dn->data_blkaddr); + dn->data_blkaddr = NEW_ADDR; + f2fs_set_data_blkaddr(dn); } f2fs_update_extent_cache_range(dn, start, 0, index - start); Patches currently in stable-queue which might be from chao@xxxxxxxxxx are queue-5.18/f2fs-fix-to-do-sanity-check-on-inline_dots-inode.patch queue-5.18/f2fs-fix-dereference-of-stale-list-iterator-after-lo.patch queue-5.18/f2fs-fix-to-do-sanity-check-on-block-address-in-f2fs_do_zero_range.patch queue-5.18/f2fs-fix-to-avoid-f2fs_bug_on-in-dec_valid_node_count.patch queue-5.18/erofs-fix-buffer-copy-overflow-of-ztailpacking-featu.patch