A null-ptr-deref bug in f2fs_write_end

mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed

* A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-19  7:13 butt3rflyh4ck
  2023-05-19 15:24 ` Chao Yu
  0 siblings, 1 reply; 6+ messages in thread
From: butt3rflyh4ck @ 2023-05-19  7:13 UTC (permalink / raw)
  To: Jaegeuk Kim, chao; +Cc: linux-f2fs-devel, LKML

Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
fs/f2fs/data.c, I reproduce it in the latest kernel too.

#Quick description
When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
fs is failed, f2fs kernel thread would  invoke callback function to
update
f2fs io info, it would call  f2fs_write_end_io and may trigger
null-ptr-deref in NODE_MAPPING.
```
static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
{
return sbi->node_inode->i_mapping;
}
```
there is deref in sbi.

#crash log
----------------------------------------
general protection fault, probably for non-canonical address
0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 bio_endio+0x5af/0x6c0 block/bio.c:1608
 req_bio_endio block/blk-mq.c:761 [inline]
 blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
 blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
 lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
 __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
 run_ksoftirqd kernel/softirq.c:939 [inline]
 run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
 kthread+0x33e/0x440 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
-----------------------

# new crash log in latest kernel
---------------------
[  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
[  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
valid(0xf2f52010) - read(0x0)
[  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
filesystem in 2th superblock
[  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
[  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
incorrect cp_ver (4542359912962316977, 0)
[  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
version = 3e17dab1
[  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
[  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
[  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
[  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
[  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
fsck to repair!
[  193.780283][    C0] general protection fault, probably for
non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
[  193.781027][    C0] KASAN: null-ptr-deref in range
[0x0000000000000030-0x0000000000000037]
[  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
[  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.15.0-1 04/01/2014
[  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[  193.787055][    C0] FS:  0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[  193.788585][    C0] Call Trace:
[  193.788863][    C0]  <TASK>
[  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
[  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
[  193.790053][    C0]  bio_endio+0x5af/0x6c0
[  193.790522][    C0]  blk_update_request+0x5cc/0x1690
[  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
[  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
[  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
[  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
[  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
[  193.793805][    C0]  run_ksoftirqd+0x31/0x60
[  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
[  193.794576][    C0]  ? sort_range+0x30/0x30
[  193.794900][    C0]  kthread+0x33e/0x440
[  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
[  193.795907][    C0]  ret_from_fork+0x1f/0x30
[  193.796324][    C0]  </TASK>
[  193.796689][    C0] Modules linked in:
[  193.797189][    C0] ---[ end trace 0000000000000000 ]---
[  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[  193.802069][    C0] FS:  0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
[  193.804748][    C0] Kernel Offset: disabled
[  193.805086][    C0] Rebooting in 86400 seconds..
----------------------------

If needed, I would provide reproduce.

Regards,
 butt3rflyh4ck.



-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: A null-ptr-deref bug in f2fs_write_end_io
  2023-05-19  7:13 A null-ptr-deref bug in f2fs_write_end_io butt3rflyh4ck
@ 2023-05-19 15:24 ` Chao Yu
  2023-05-22  3:58   ` butt3rflyh4ck
  0 siblings, 1 reply; 6+ messages in thread
From: Chao Yu @ 2023-05-19 15:24 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim

Hi,

Thanks for the report, it will be helpful if you can provide a
reproducer.

On 2023/5/19 15:13, butt3rflyh4ck wrote:
> Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
> fs/f2fs/data.c, I reproduce it in the latest kernel too.
> 
> #Quick description
> When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
> fs is failed, f2fs kernel thread would  invoke callback function to
> update
> f2fs io info, it would call  f2fs_write_end_io and may trigger
> null-ptr-deref in NODE_MAPPING.
> ```
> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> {
> return sbi->node_inode->i_mapping;
> }
> ```
> there is deref in sbi.
> 
> #crash log
> ----------------------------------------
> general protection fault, probably for non-canonical address
> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> Call Trace:
>   <TASK>
>   bio_endio+0x5af/0x6c0 block/bio.c:1608
>   req_bio_endio block/blk-mq.c:761 [inline]
>   blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>   blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>   lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>   blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>   __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>   run_ksoftirqd kernel/softirq.c:939 [inline]
>   run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>   smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>   kthread+0x33e/0x440 kernel/kthread.c:379
>   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>   </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> -----------------------
> 
> # new crash log in latest kernel
> ---------------------
> [  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> [  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> valid(0xf2f52010) - read(0x0)
> [  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> filesystem in 2th superblock
> [  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> [  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> incorrect cp_ver (4542359912962316977, 0)
> [  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> [  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> version = 3e17dab1
> [  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> [  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> [  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> [  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> [  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> fsck to repair!
> [  193.780283][    C0] general protection fault, probably for
> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> [  193.781027][    C0] KASAN: null-ptr-deref in range
> [0x0000000000000030-0x0000000000000037]
> [  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> [  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [  193.787055][    C0] FS:  0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [  193.788585][    C0] Call Trace:
> [  193.788863][    C0]  <TASK>
> [  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
> [  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
> [  193.790053][    C0]  bio_endio+0x5af/0x6c0
> [  193.790522][    C0]  blk_update_request+0x5cc/0x1690
> [  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
> [  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
> [  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
> [  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
> [  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
> [  193.793805][    C0]  run_ksoftirqd+0x31/0x60
> [  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
> [  193.794576][    C0]  ? sort_range+0x30/0x30
> [  193.794900][    C0]  kthread+0x33e/0x440
> [  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
> [  193.795907][    C0]  ret_from_fork+0x1f/0x30
> [  193.796324][    C0]  </TASK>
> [  193.796689][    C0] Modules linked in:
> [  193.797189][    C0] ---[ end trace 0000000000000000 ]---
> [  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [  193.802069][    C0] FS:  0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
> [  193.804748][    C0] Kernel Offset: disabled
> [  193.805086][    C0] Rebooting in 86400 seconds..
> ----------------------------
> 
> If needed, I would provide reproduce.
> 
> Regards,
>   butt3rflyh4ck.
> 
> 
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: A null-ptr-deref bug in f2fs_write_end_io
  2023-05-19 15:24 ` Chao Yu
@ 2023-05-22  3:58   ` butt3rflyh4ck
  2023-05-22 12:44     ` Chao Yu
  0 siblings, 1 reply; 6+ messages in thread
From: butt3rflyh4ck @ 2023-05-22  3:58 UTC (permalink / raw)
  To: Chao Yu; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim

[-- Attachment #1: Type: text/plain, Size: 9354 bytes --]

OK, the attachment is a reproducer.

Regards.
 butt3rflyh4ck.

On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>
> Hi,
>
> Thanks for the report, it will be helpful if you can provide a
> reproducer.
>
> On 2023/5/19 15:13, butt3rflyh4ck wrote:
> > Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
> > fs/f2fs/data.c, I reproduce it in the latest kernel too.
> >
> > #Quick description
> > When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
> > fs is failed, f2fs kernel thread would  invoke callback function to
> > update
> > f2fs io info, it would call  f2fs_write_end_io and may trigger
> > null-ptr-deref in NODE_MAPPING.
> > ```
> > static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> > {
> > return sbi->node_inode->i_mapping;
> > }
> > ```
> > there is deref in sbi.
> >
> > #crash log
> > ----------------------------------------
> > general protection fault, probably for non-canonical address
> > 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> > KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> > CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> > RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> > Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> > 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> > 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> > RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> > RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> > RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> > R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> > FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > Call Trace:
> >   <TASK>
> >   bio_endio+0x5af/0x6c0 block/bio.c:1608
> >   req_bio_endio block/blk-mq.c:761 [inline]
> >   blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> >   blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> >   lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> >   blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> >   __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> >   run_ksoftirqd kernel/softirq.c:939 [inline]
> >   run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> >   smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> >   kthread+0x33e/0x440 kernel/kthread.c:379
> >   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> >   </TASK>
> > Modules linked in:
> > ---[ end trace 0000000000000000 ]---
> > RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> > RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> > Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> > 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> > 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> > RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> > RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> > RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> > R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> > FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > -----------------------
> >
> > # new crash log in latest kernel
> > ---------------------
> > [  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> > [  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> > valid(0xf2f52010) - read(0x0)
> > [  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> > filesystem in 2th superblock
> > [  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> > [  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> > incorrect cp_ver (4542359912962316977, 0)
> > [  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> > [  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> > version = 3e17dab1
> > [  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> > [  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> > [  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> > [  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> > [  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> > fsck to repair!
> > [  193.780283][    C0] general protection fault, probably for
> > non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> > [  193.781027][    C0] KASAN: null-ptr-deref in range
> > [0x0000000000000030-0x0000000000000037]
> > [  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> > 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> > [  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> > 1996), BIOS 1.15.0-1 04/01/2014
> > [  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> > [  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> > 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> > f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> > [  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > [  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> > RCX: 0000000000000100
> > [  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> > RDI: 0000000000000030
> > [  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> > R09: 0000000000000000
> > [  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
> > R12: ffffea000143e740
> > [  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
> > R15: 0000000000000000
> > [  193.787055][    C0] FS:  0000000000000000(0000)
> > GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > [  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> > CR4: 00000000000006f0
> > [  193.788585][    C0] Call Trace:
> > [  193.788863][    C0]  <TASK>
> > [  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
> > [  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
> > [  193.790053][    C0]  bio_endio+0x5af/0x6c0
> > [  193.790522][    C0]  blk_update_request+0x5cc/0x1690
> > [  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
> > [  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
> > [  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
> > [  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
> > [  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
> > [  193.793805][    C0]  run_ksoftirqd+0x31/0x60
> > [  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
> > [  193.794576][    C0]  ? sort_range+0x30/0x30
> > [  193.794900][    C0]  kthread+0x33e/0x440
> > [  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
> > [  193.795907][    C0]  ret_from_fork+0x1f/0x30
> > [  193.796324][    C0]  </TASK>
> > [  193.796689][    C0] Modules linked in:
> > [  193.797189][    C0] ---[ end trace 0000000000000000 ]---
> > [  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> > [  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> > 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> > f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> > [  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > [  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> > RCX: 0000000000000100
> > [  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> > RDI: 0000000000000030
> > [  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> > R09: 0000000000000000
> > [  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
> > R12: ffffea000143e740
> > [  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
> > R15: 0000000000000000
> > [  193.802069][    C0] FS:  0000000000000000(0000)
> > GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > [  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> > CR4: 00000000000006f0
> > [  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
> > [  193.804748][    C0] Kernel Offset: disabled
> > [  193.805086][    C0] Rebooting in 86400 seconds..
> > ----------------------------
> >
> > If needed, I would provide reproduce.
> >
> > Regards,
> >   butt3rflyh4ck.
> >
> >
> >



-- 
Active Defense Lab of Venustech

[-- Attachment #2: repro.cprog --]
[-- Type: application/octet-stream, Size: 18240 bytes --]

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/futex.h>
#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir(void)
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    exit(1);
  if (chmod(tmpdir, 0777))
    exit(1);
  if (chdir(tmpdir))
    exit(1);
}

static void thread_start(void* (*fn)(void*), void* arg)
{
  pthread_t th;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, 128 << 10);
  int i = 0;
  for (; i < 100; i++) {
    if (pthread_create(&th, &attr, fn, arg) == 0) {
      pthread_attr_destroy(&attr);
      return;
    }
    if (errno == EAGAIN) {
      usleep(50);
      continue;
    }
    break;
  }
  exit(1);
}

typedef struct {
  int state;
} event_t;

static void event_init(event_t* ev)
{
  ev->state = 0;
}

static void event_reset(event_t* ev)
{
  ev->state = 0;
}

static void event_set(event_t* ev)
{
  if (ev->state)
    exit(1);
  __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
  syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
  while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
  return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
  uint64_t start = current_time_ms();
  uint64_t now = start;
  for (;;) {
    uint64_t remain = timeout - (now - start);
    struct timespec ts;
    ts.tv_sec = remain / 1000;
    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
    if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
      return 1;
    now = current_time_ms();
    if (now - start > timeout)
      return 0;
  }
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

struct fs_image_segment {
  void* data;
  uintptr_t size;
  uintptr_t offset;
};

#define IMAGE_MAX_SEGMENTS 4096
#define IMAGE_MAX_SIZE (129 << 20)

static unsigned long fs_image_segment_check(unsigned long size,
                                            unsigned long nsegs,
                                            struct fs_image_segment* segs)
{
  if (nsegs > IMAGE_MAX_SEGMENTS)
    nsegs = IMAGE_MAX_SEGMENTS;
  for (size_t i = 0; i < nsegs; i++) {
    if (segs[i].size > IMAGE_MAX_SIZE)
      segs[i].size = IMAGE_MAX_SIZE;
    segs[i].offset %= IMAGE_MAX_SIZE;
    if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size)
      segs[i].offset = IMAGE_MAX_SIZE - segs[i].size;
    if (size < segs[i].offset + segs[i].offset)
      size = segs[i].offset + segs[i].offset;
  }
  if (size > IMAGE_MAX_SIZE)
    size = IMAGE_MAX_SIZE;
  return size;
}
static int setup_loop_device(long unsigned size, long unsigned nsegs,
                             struct fs_image_segment* segs,
                             const char* loopname, int* memfd_p, int* loopfd_p)
{
  int err = 0, loopfd = -1;
  size = fs_image_segment_check(size, nsegs, segs);
  int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
  if (memfd == -1) {
    err = errno;
    goto error;
  }
  if (ftruncate(memfd, size)) {
    err = errno;
    goto error_close_memfd;
  }
  for (size_t i = 0; i < nsegs; i++) {
    if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
    }
  }
  loopfd = open(loopname, O_RDWR);
  if (loopfd == -1) {
    err = errno;
    goto error_close_memfd;
  }
  if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
    if (errno != EBUSY) {
      err = errno;
      goto error_close_loop;
    }
    ioctl(loopfd, LOOP_CLR_FD, 0);
    usleep(1000);
    if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
      err = errno;
      goto error_close_loop;
    }
  }
  *memfd_p = memfd;
  *loopfd_p = loopfd;
  return 0;

error_close_loop:
  close(loopfd);
error_close_memfd:
  close(memfd);
error:
  errno = err;
  return -1;
}

static long syz_mount_image(volatile long fsarg, volatile long dir,
                            volatile unsigned long size,
                            volatile unsigned long nsegs,
                            volatile long segments, volatile long flags,
                            volatile long optsarg, volatile long change_dir)
{
  struct fs_image_segment* segs = (struct fs_image_segment*)segments;
  int res = -1, err = 0, loopfd = -1, memfd = -1, need_loop_device = !!segs;
  char* mount_opts = (char*)optsarg;
  char* target = (char*)dir;
  char* fs = (char*)fsarg;
  char* source = NULL;
  char loopname[64];
  if (need_loop_device) {
    memset(loopname, 0, sizeof(loopname));
    snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
    if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1)
      return -1;
    source = loopname;
  }
  mkdir(target, 0777);
  char opts[256];
  memset(opts, 0, sizeof(opts));
  if (strlen(mount_opts) > (sizeof(opts) - 32)) {
  }
  strncpy(opts, mount_opts, sizeof(opts) - 32);
  if (strcmp(fs, "iso9660") == 0) {
    flags |= MS_RDONLY;
  } else if (strncmp(fs, "ext", 3) == 0) {
    if (strstr(opts, "errors=panic") || strstr(opts, "errors=remount-ro") == 0)
      strcat(opts, ",errors=continue");
  } else if (strcmp(fs, "xfs") == 0) {
    strcat(opts, ",nouuid");
  }
  res = mount(source, target, fs, flags, opts);
  if (res == -1) {
    err = errno;
    goto error_clear_loop;
  }
  res = open(target, O_RDONLY | O_DIRECTORY);
  if (res == -1) {
    err = errno;
    goto error_clear_loop;
  }
  if (change_dir) {
    res = chdir(target);
    if (res == -1) {
      err = errno;
    }
  }

error_clear_loop:
  if (need_loop_device) {
    ioctl(loopfd, LOOP_CLR_FD, 0);
    close(loopfd);
    close(memfd);
  }
  errno = err;
  return res;
}

#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
  int iter = 0;
  DIR* dp = 0;
retry:
  while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
  }
  dp = opendir(dir);
  if (dp == NULL) {
    if (errno == EMFILE) {
      exit(1);
    }
    exit(1);
  }
  struct dirent* ep = 0;
  while ((ep = readdir(dp))) {
    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
      continue;
    char filename[FILENAME_MAX];
    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
    while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
    }
    struct stat st;
    if (lstat(filename, &st))
      exit(1);
    if (S_ISDIR(st.st_mode)) {
      remove_dir(filename);
      continue;
    }
    int i;
    for (i = 0;; i++) {
      if (unlink(filename) == 0)
        break;
      if (errno == EPERM) {
        int fd = open(filename, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno != EBUSY || i > 100)
        exit(1);
      if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
        exit(1);
    }
  }
  closedir(dp);
  for (int i = 0;; i++) {
    if (rmdir(dir) == 0)
      break;
    if (i < 100) {
      if (errno == EPERM) {
        int fd = open(dir, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno == EBUSY) {
        if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
          exit(1);
        continue;
      }
      if (errno == ENOTEMPTY) {
        if (iter < 100) {
          iter++;
          goto retry;
        }
      }
    }
    exit(1);
  }
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void reset_loop()
{
  char buf[64];
  snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
  int loopfd = open(buf, O_RDWR);
  if (loopfd != -1) {
    ioctl(loopfd, LOOP_CLR_FD, 0);
    close(loopfd);
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

struct thread_t {
  int created, call;
  event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    event_wait(&th->ready);
    event_reset(&th->ready);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    event_set(&th->done);
  }
  return 0;
}

static void execute_one(void)
{
  int i, call, thread;
  for (call = 0; call < 3; call++) {
    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
         thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        event_init(&th->ready);
        event_init(&th->done);
        event_set(&th->done);
        thread_start(thr, th);
      }
      if (!event_isset(&th->done))
        continue;
      event_reset(&th->done);
      th->call = call;
      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
      event_set(&th->ready);
      if (call == 1)
        break;
      event_timedwait(&th->done,
                      50 + (call == 0 ? 50 : 0) + (call == 2 ? 50 : 0));
      break;
    }
  }
  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
    sleep_ms(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    char cwdbuf[32];
    sprintf(cwdbuf, "./%d", iter);
    if (mkdir(cwdbuf, 0777))
      exit(1);
    reset_loop();
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      if (chdir(cwdbuf))
        exit(1);
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    remove_dir(cwdbuf);
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_call(int call)
{
  intptr_t res = 0;
  switch (call) {
  case 0:
    memcpy((void*)0x20000000, "f2fs\000", 5);
    memcpy((void*)0x20000100, "./file0\000", 8);
    *(uint64_t*)0x20000200 = 0x20010000;
    memcpy((void*)0x20010000,
           "\x10\x20\xf5\xf2\x01\x00\x0e\x00\x09\x00\x00\x00\x03\x00\x00\x00"
           "\x0c\x00\x00\x00\x09\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00"
           "\x3e\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00"
           "\x02\x00\x00\x00\x36\x00\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00"
           "\x00\x08\x00\x00\x00\x0c\x00\x00\x00\x10\x00\x00\x00\x14\x00\x00"
           "\x03\x00\x00\x00\x01\x00\x00\x00\x02",
           105);
    *(uint64_t*)0x20000208 = 0x69;
    *(uint64_t*)0x20000210 = 0x400;
    *(uint64_t*)0x20000218 = 0x20010740;
    memcpy(
        (void*)0x20010740,
        "\xb1\xda\x17\x3e\x00\x00\x00\x00\x00\x24\x00\x00\x00\x00\x00\x00\x0b"
        "\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x24\x00\x00\x00\x30\x00"
        "\x00\x00\x34\x00\x00\x00\x32\x00\x00\x00\x30\x00\x00\x00\xff\xff\xff"
        "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
        "\x03\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e"
        "\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff"
        "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x05\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc5\x01\x00\x00"
        "\x06\x00\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x07\x00\x00\x00\x0a"
        "\x00\x00\x00\x40\x00\x00\x00\x40\x00\x00\x00\xfc\x0f",
        166);
    *(uint64_t*)0x20000220 = 0xa6;
    *(uint64_t*)0x20000228 = 0x400000;
    *(uint64_t*)0x20000230 = 0x20010800;
    memcpy((void*)0x20010800,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\xb4\x09\x3f",
           32);
    *(uint64_t*)0x20000238 = 0x20;
    *(uint64_t*)0x20000240 = 0x400fe0;
    *(uint64_t*)0x20000248 = 0x20010840;
    memcpy((void*)0x20010840,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06",
           28);
    *(uint64_t*)0x20000250 = 0x1c;
    *(uint64_t*)0x20000258 = 0x4011e0;
    *(uint64_t*)0x20000260 = 0x200108e0;
    memcpy((void*)0x200108e0,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x32\x00\x00\x00\x05\x10\xec",
           28);
    *(uint64_t*)0x20000268 = 0x1c;
    *(uint64_t*)0x20000270 = 0x401320;
    *(uint64_t*)0x20000278 = 0x20010900;
    memcpy((void*)0x20010900, "\x00\x00\x00\x34\x00\x00\x00\x02\x0c\x60", 10);
    *(uint64_t*)0x20000280 = 0xa;
    *(uint64_t*)0x20000288 = 0x401380;
    *(uint64_t*)0x20000290 = 0x20010a20;
    memcpy(
        (void*)0x20010a20,
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xb1\xda"
        "\x17\x3e\x00\x00\x00\x00\x00\x24\x00\x00\x00\x00\x00\x00\x0b\x00\x00"
        "\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x24\x00\x00\x00\x30\x00\x00\x00"
        "\x34\x00\x00\x00\x32\x00\x00\x00\x30\x00\x00\x00\xff\xff\xff\xff\xff"
        "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x03\x00"
        "\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00"
        "\x00\x02\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff"
        "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x05\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc5\x01\x00\x00\x06\x00"
        "\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x07\x00\x00\x00\x0a\x00\x00"
        "\x00\x40\x00\x00\x00\x40\x00\x00\x00\xfc\x0f",
        198);
    *(uint64_t*)0x20000298 = 0xc6;
    *(uint64_t*)0x200002a0 = 0x404fe0;
    *(uint64_t*)0x200002a8 = 0x20010b00;
    memcpy((void*)0x20010b00,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\xb4\x09\x3f",
           32);
    *(uint64_t*)0x200002b0 = 0x20;
    *(uint64_t*)0x200002b8 = 0x405fe0;
    *(uint64_t*)0x200002c0 = 0x20011000;
    memcpy(
        (void*)0x20011000,
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00"
        "\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\x00\x03\x00\x00\x00\x01\x7c",
        34);
    *(uint64_t*)0x200002c8 = 0x22;
    *(uint64_t*)0x200002d0 = 0xc00000;
    *(uint64_t*)0x200002d8 = 0x20011a60;
    memcpy((void*)0x20011a60,
           "\xed\x41\x00\x00\x80\x76\x10\x00\x53\x5f\x01\x00\x03\x00\x00\x00"
           "\x00\x10\x00\x00\x00\x00\x00\x00\x02",
           25);
    *(uint64_t*)0x200002e0 = 0x19;
    *(uint64_t*)0x200002e8 = 0x7c01000;
    *(uint64_t*)0x200002f0 = 0x20011ae0;
    memcpy((void*)0x20011ae0,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x03", 13);
    *(uint64_t*)0x200002f8 = 0xd;
    *(uint64_t*)0x20000300 = 0x7c01fe0;
    res = -1;
    res = syz_mount_image(0x20000000, 0x20000100, 0, 0xb, 0x20000200, 0,
                          0x20000040, 0);
    if (res != -1)
      r[0] = res;
    break;
  case 1:
    *(uint64_t*)0x20000140 = 0x6000;
    syscall(__NR_ioctl, r[0], 0x4008f510, 0x20000140ul);
    break;
  case 2:
    memcpy((void*)0x20000580, "f2fs\000", 5);
    memcpy((void*)0x20000080, "./file0\000", 8);
    *(uint8_t*)0x200001c0 = 0;
    syz_mount_image(0x20000580, 0x20000080, 0, 0, 0, 0x4a03f, 0x200001c0, 0);
    break;
  }
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  use_temporary_dir();
  loop();
  return 0;
}

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: A null-ptr-deref bug in f2fs_write_end_io
  2023-05-22  3:58   ` butt3rflyh4ck
@ 2023-05-22 12:44     ` Chao Yu
  2023-05-22 14:20       ` butt3rflyh4ck
  0 siblings, 1 reply; 6+ messages in thread
From: Chao Yu @ 2023-05-22 12:44 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim

On 2023/5/22 11:58, butt3rflyh4ck wrote:
> OK, the attachment is a reproducer.

Thank you!

I've figured out a patch, could you please have a try w/ this patch?

https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/

Thanks,

> 
> Regards.
>   butt3rflyh4ck.
> 
> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>
>> Hi,
>>
>> Thanks for the report, it will be helpful if you can provide a
>> reproducer.
>>
>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>> Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>
>>> #Quick description
>>> When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
>>> fs is failed, f2fs kernel thread would  invoke callback function to
>>> update
>>> f2fs io info, it would call  f2fs_write_end_io and may trigger
>>> null-ptr-deref in NODE_MAPPING.
>>> ```
>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>> {
>>> return sbi->node_inode->i_mapping;
>>> }
>>> ```
>>> there is deref in sbi.
>>>
>>> #crash log
>>> ----------------------------------------
>>> general protection fault, probably for non-canonical address
>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> Call Trace:
>>>    <TASK>
>>>    bio_endio+0x5af/0x6c0 block/bio.c:1608
>>>    req_bio_endio block/blk-mq.c:761 [inline]
>>>    blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>>    blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>>    lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>>    blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>>    __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>>    run_ksoftirqd kernel/softirq.c:939 [inline]
>>>    run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>>    smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>>    kthread+0x33e/0x440 kernel/kthread.c:379
>>>    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>>    </TASK>
>>> Modules linked in:
>>> ---[ end trace 0000000000000000 ]---
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> -----------------------
>>>
>>> # new crash log in latest kernel
>>> ---------------------
>>> [  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>> [  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>> valid(0xf2f52010) - read(0x0)
>>> [  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>> filesystem in 2th superblock
>>> [  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>> [  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>> incorrect cp_ver (4542359912962316977, 0)
>>> [  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>> [  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>> version = 3e17dab1
>>> [  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>> [  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>> [  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>> [  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>> [  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>> fsck to repair!
>>> [  193.780283][    C0] general protection fault, probably for
>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> [  193.781027][    C0] KASAN: null-ptr-deref in range
>>> [0x0000000000000030-0x0000000000000037]
>>> [  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>> [  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>> 1996), BIOS 1.15.0-1 04/01/2014
>>> [  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [  193.787055][    C0] FS:  0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [  193.788585][    C0] Call Trace:
>>> [  193.788863][    C0]  <TASK>
>>> [  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
>>> [  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
>>> [  193.790053][    C0]  bio_endio+0x5af/0x6c0
>>> [  193.790522][    C0]  blk_update_request+0x5cc/0x1690
>>> [  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
>>> [  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
>>> [  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
>>> [  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
>>> [  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
>>> [  193.793805][    C0]  run_ksoftirqd+0x31/0x60
>>> [  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
>>> [  193.794576][    C0]  ? sort_range+0x30/0x30
>>> [  193.794900][    C0]  kthread+0x33e/0x440
>>> [  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
>>> [  193.795907][    C0]  ret_from_fork+0x1f/0x30
>>> [  193.796324][    C0]  </TASK>
>>> [  193.796689][    C0] Modules linked in:
>>> [  193.797189][    C0] ---[ end trace 0000000000000000 ]---
>>> [  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [  193.802069][    C0] FS:  0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
>>> [  193.804748][    C0] Kernel Offset: disabled
>>> [  193.805086][    C0] Rebooting in 86400 seconds..
>>> ----------------------------
>>>
>>> If needed, I would provide reproduce.
>>>
>>> Regards,
>>>    butt3rflyh4ck.
>>>
>>>
>>>
> 
> 
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: A null-ptr-deref bug in f2fs_write_end_io
  2023-05-22 12:44     ` Chao Yu
@ 2023-05-22 14:20       ` butt3rflyh4ck
  2023-05-23  1:01         ` Chao Yu
  0 siblings, 1 reply; 6+ messages in thread
From: butt3rflyh4ck @ 2023-05-22 14:20 UTC (permalink / raw)
  To: Chao Yu; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim

I have tested the patch, it works fine.


Regards,
 butt3rflyh4ck.

On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>
> On 2023/5/22 11:58, butt3rflyh4ck wrote:
> > OK, the attachment is a reproducer.
>
> Thank you!
>
> I've figured out a patch, could you please have a try w/ this patch?
>
> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>
> Thanks,
>
> >
> > Regards.
> >   butt3rflyh4ck.
> >
> > On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
> >>
> >> Hi,
> >>
> >> Thanks for the report, it will be helpful if you can provide a
> >> reproducer.
> >>
> >> On 2023/5/19 15:13, butt3rflyh4ck wrote:
> >>> Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
> >>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
> >>>
> >>> #Quick description
> >>> When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
> >>> fs is failed, f2fs kernel thread would  invoke callback function to
> >>> update
> >>> f2fs io info, it would call  f2fs_write_end_io and may trigger
> >>> null-ptr-deref in NODE_MAPPING.
> >>> ```
> >>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> >>> {
> >>> return sbi->node_inode->i_mapping;
> >>> }
> >>> ```
> >>> there is deref in sbi.
> >>>
> >>> #crash log
> >>> ----------------------------------------
> >>> general protection fault, probably for non-canonical address
> >>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> >>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> Call Trace:
> >>>    <TASK>
> >>>    bio_endio+0x5af/0x6c0 block/bio.c:1608
> >>>    req_bio_endio block/blk-mq.c:761 [inline]
> >>>    blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> >>>    blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> >>>    lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> >>>    blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> >>>    __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> >>>    run_ksoftirqd kernel/softirq.c:939 [inline]
> >>>    run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> >>>    smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> >>>    kthread+0x33e/0x440 kernel/kthread.c:379
> >>>    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> >>>    </TASK>
> >>> Modules linked in:
> >>> ---[ end trace 0000000000000000 ]---
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> -----------------------
> >>>
> >>> # new crash log in latest kernel
> >>> ---------------------
> >>> [  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> >>> [  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> >>> valid(0xf2f52010) - read(0x0)
> >>> [  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> >>> filesystem in 2th superblock
> >>> [  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> >>> [  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> >>> incorrect cp_ver (4542359912962316977, 0)
> >>> [  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> >>> [  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> >>> version = 3e17dab1
> >>> [  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> >>> [  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> >>> [  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> >>> [  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> >>> [  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> >>> fsck to repair!
> >>> [  193.780283][    C0] general protection fault, probably for
> >>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> [  193.781027][    C0] KASAN: null-ptr-deref in range
> >>> [0x0000000000000030-0x0000000000000037]
> >>> [  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> >>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> >>> [  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >>> 1996), BIOS 1.15.0-1 04/01/2014
> >>> [  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [  193.787055][    C0] FS:  0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [  193.788585][    C0] Call Trace:
> >>> [  193.788863][    C0]  <TASK>
> >>> [  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
> >>> [  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
> >>> [  193.790053][    C0]  bio_endio+0x5af/0x6c0
> >>> [  193.790522][    C0]  blk_update_request+0x5cc/0x1690
> >>> [  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
> >>> [  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
> >>> [  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
> >>> [  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
> >>> [  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
> >>> [  193.793805][    C0]  run_ksoftirqd+0x31/0x60
> >>> [  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
> >>> [  193.794576][    C0]  ? sort_range+0x30/0x30
> >>> [  193.794900][    C0]  kthread+0x33e/0x440
> >>> [  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
> >>> [  193.795907][    C0]  ret_from_fork+0x1f/0x30
> >>> [  193.796324][    C0]  </TASK>
> >>> [  193.796689][    C0] Modules linked in:
> >>> [  193.797189][    C0] ---[ end trace 0000000000000000 ]---
> >>> [  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [  193.802069][    C0] FS:  0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
> >>> [  193.804748][    C0] Kernel Offset: disabled
> >>> [  193.805086][    C0] Rebooting in 86400 seconds..
> >>> ----------------------------
> >>>
> >>> If needed, I would provide reproduce.
> >>>
> >>> Regards,
> >>>    butt3rflyh4ck.
> >>>
> >>>
> >>>
> >
> >
> >



-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: A null-ptr-deref bug in f2fs_write_end_io
  2023-05-22 14:20       ` butt3rflyh4ck
@ 2023-05-23  1:01         ` Chao Yu
  0 siblings, 0 replies; 6+ messages in thread
From: Chao Yu @ 2023-05-23  1:01 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim

On 2023/5/22 22:20, butt3rflyh4ck wrote:
> I have tested the patch, it works fine.

Thank you, I'd like to add below tag in the patch if you don't mind.

Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>

Thanks,

> 
> 
> Regards,
>   butt3rflyh4ck.
> 
> On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>>
>> On 2023/5/22 11:58, butt3rflyh4ck wrote:
>>> OK, the attachment is a reproducer.
>>
>> Thank you!
>>
>> I've figured out a patch, could you please have a try w/ this patch?
>>
>> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>>
>> Thanks,
>>
>>>
>>> Regards.
>>>    butt3rflyh4ck.
>>>
>>> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for the report, it will be helpful if you can provide a
>>>> reproducer.
>>>>
>>>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>>>> Hi, there is a null-ptr-deref  bug in f2fs_write_end_io in
>>>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>>>
>>>>> #Quick description
>>>>> When a thread always calls F2FS_IOC_RESIZE_FS to  resize fs, if resize
>>>>> fs is failed, f2fs kernel thread would  invoke callback function to
>>>>> update
>>>>> f2fs io info, it would call  f2fs_write_end_io and may trigger
>>>>> null-ptr-deref in NODE_MAPPING.
>>>>> ```
>>>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>>>> {
>>>>> return sbi->node_inode->i_mapping;
>>>>> }
>>>>> ```
>>>>> there is deref in sbi.
>>>>>
>>>>> #crash log
>>>>> ----------------------------------------
>>>>> general protection fault, probably for non-canonical address
>>>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> Call Trace:
>>>>>     <TASK>
>>>>>     bio_endio+0x5af/0x6c0 block/bio.c:1608
>>>>>     req_bio_endio block/blk-mq.c:761 [inline]
>>>>>     blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>>>>     blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>>>>     lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>>>>     blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>>>>     __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>>>>     run_ksoftirqd kernel/softirq.c:939 [inline]
>>>>>     run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>>>>     smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>>>>     kthread+0x33e/0x440 kernel/kthread.c:379
>>>>>     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>>>>     </TASK>
>>>>> Modules linked in:
>>>>> ---[ end trace 0000000000000000 ]---
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS:  0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> -----------------------
>>>>>
>>>>> # new crash log in latest kernel
>>>>> ---------------------
>>>>> [  193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>>>> [  193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>>>> valid(0xf2f52010) - read(0x0)
>>>>> [  193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>>>> filesystem in 2th superblock
>>>>> [  193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>>>> [  193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>>>> incorrect cp_ver (4542359912962316977, 0)
>>>>> [  193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>>>> [  193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>>>> version = 3e17dab1
>>>>> [  193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>>>> [  193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>>>> [  193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>>>> [  193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>>>> [  193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>>>> fsck to repair!
>>>>> [  193.780283][    C0] general protection fault, probably for
>>>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> [  193.781027][    C0] KASAN: null-ptr-deref in range
>>>>> [0x0000000000000030-0x0000000000000037]
>>>>> [  193.781572][    C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>>>> [  193.782201][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>>>> 1996), BIOS 1.15.0-1 04/01/2014
>>>>> [  193.782727][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [  193.783083][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [  193.784268][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [  193.784629][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [  193.785109][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [  193.785576][    C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [  193.786051][    C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [  193.786571][    C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [  193.787055][    C0] FS:  0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [  193.787620][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [  193.787997][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [  193.788585][    C0] Call Trace:
>>>>> [  193.788863][    C0]  <TASK>
>>>>> [  193.789115][    C0]  ? bio_uninit+0x1b7/0x410
>>>>> [  193.789509][    C0]  ? f2fs_write_end+0xa80/0xa80
>>>>> [  193.790053][    C0]  bio_endio+0x5af/0x6c0
>>>>> [  193.790522][    C0]  blk_update_request+0x5cc/0x1690
>>>>> [  193.791171][    C0]  blk_mq_end_request+0x59/0x4c0
>>>>> [  193.791695][    C0]  lo_complete_rq+0x1c6/0x280
>>>>> [  193.792247][    C0]  blk_complete_reqs+0xad/0xe0
>>>>> [  193.792759][    C0]  __do_softirq+0x1d4/0x8ef
>>>>> [  193.793312][    C0]  ? __irq_exit_rcu+0x190/0x190
>>>>> [  193.793805][    C0]  run_ksoftirqd+0x31/0x60
>>>>> [  193.794183][    C0]  smpboot_thread_fn+0x659/0x9e0
>>>>> [  193.794576][    C0]  ? sort_range+0x30/0x30
>>>>> [  193.794900][    C0]  kthread+0x33e/0x440
>>>>> [  193.795263][    C0]  ? kthread_complete_and_exit+0x40/0x40
>>>>> [  193.795907][    C0]  ret_from_fork+0x1f/0x30
>>>>> [  193.796324][    C0]  </TASK>
>>>>> [  193.796689][    C0] Modules linked in:
>>>>> [  193.797189][    C0] ---[ end trace 0000000000000000 ]---
>>>>> [  193.797635][    C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [  193.798182][    C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [  193.799559][    C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [  193.799945][    C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [  193.800329][    C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [  193.800666][    C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [  193.801047][    C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [  193.801503][    C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [  193.802069][    C0] FS:  0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [  193.802804][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [  193.803356][    C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [  193.804046][    C0] Kernel panic - not syncing: Fatal exception in interrupt
>>>>> [  193.804748][    C0] Kernel Offset: disabled
>>>>> [  193.805086][    C0] Rebooting in 86400 seconds..
>>>>> ----------------------------
>>>>>
>>>>> If needed, I would provide reproduce.
>>>>>
>>>>> Regards,
>>>>>     butt3rflyh4ck.
>>>>>
>>>>>
>>>>>
>>>
>>>
>>>
> 
> 
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2023-05-23  1:03 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-19  7:13 A null-ptr-deref bug in f2fs_write_end_io butt3rflyh4ck
2023-05-19 15:24 ` Chao Yu
2023-05-22  3:58   ` butt3rflyh4ck
2023-05-22 12:44     ` Chao Yu
2023-05-22 14:20       ` butt3rflyh4ck
2023-05-23  1:01         ` Chao Yu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®