This is a note to let you know that I've just added the patch titled f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: f2fs-fix-to-avoid-f2fs_bug_on-in-dec_valid_node_count.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 4d17e6fe9293d57081ffdc11e1cf313e25e8fd9e Mon Sep 17 00:00:00 2001 From: Chao Yu <chao@xxxxxxxxxx> Date: Wed, 27 Apr 2022 01:06:02 +0800 Subject: f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() From: Chao Yu <chao@xxxxxxxxxx> commit 4d17e6fe9293d57081ffdc11e1cf313e25e8fd9e upstream. As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215897 I have encountered a bug in F2FS file system in kernel v5.17. The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands: The kernel message is shown below: kernel BUG at fs/f2fs/f2fs.h:2511! Call Trace: f2fs_remove_inode_page+0x2a2/0x830 f2fs_evict_inode+0x9b7/0x1510 evict+0x282/0x4e0 do_unlinkat+0x33a/0x540 __x64_sys_unlinkat+0x8e/0xd0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is: .total_valid_block_count or .total_valid_node_count could fuzzed to zero, then once dec_valid_node_count() was called, it will cause BUG_ON(), this patch fixes to print warning info and set SBI_NEED_FSCK into CP instead of panic. Cc: stable@xxxxxxxxxxxxxxx Reported-by: Ming Yan <yanming@xxxxxxxxxx> Signed-off-by: Chao Yu <chao.yu@xxxxxxxx> Signed-off-by: Jaegeuk Kim <jaegeuk@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/f2fs/f2fs.h | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -2605,11 +2605,17 @@ static inline void dec_valid_node_count( { spin_lock(&sbi->stat_lock); - f2fs_bug_on(sbi, !sbi->total_valid_block_count); - f2fs_bug_on(sbi, !sbi->total_valid_node_count); + if (unlikely(!sbi->total_valid_block_count || + !sbi->total_valid_node_count)) { + f2fs_warn(sbi, "dec_valid_node_count: inconsistent block counts, total_valid_block:%u, total_valid_node:%u", + sbi->total_valid_block_count, + sbi->total_valid_node_count); + set_sbi_flag(sbi, SBI_NEED_FSCK); + } else { + sbi->total_valid_block_count--; + sbi->total_valid_node_count--; + } - sbi->total_valid_node_count--; - sbi->total_valid_block_count--; if (sbi->reserved_blocks && sbi->current_reserved_blocks < sbi->reserved_blocks) sbi->current_reserved_blocks++; Patches currently in stable-queue which might be from chao@xxxxxxxxxx are queue-5.18/f2fs-fix-to-do-sanity-check-on-inline_dots-inode.patch queue-5.18/f2fs-fix-dereference-of-stale-list-iterator-after-lo.patch queue-5.18/f2fs-fix-to-do-sanity-check-on-block-address-in-f2fs_do_zero_range.patch queue-5.18/f2fs-fix-to-avoid-f2fs_bug_on-in-dec_valid_node_count.patch queue-5.18/erofs-fix-buffer-copy-overflow-of-ztailpacking-featu.patch