From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A09F167DAC for ; Mon, 20 Jan 2025 11:19:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737371996; cv=none; b=de02VYG4g+wB8PJndp6FccVS9+ZdBgfzNVGVGoAYmadrCWWbm7kmlZXDnEVM6Lh68B1uiyfNCVxKxHXW5WcvYVG/dyAD40UeiCCUd/PHyCsuLC7FNn0WPj7CV2QpjhFMSQqOwiwZalvV98JMcj2ExgO1rhR2sFBLwGTJS/Qpngs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737371996; c=relaxed/simple; bh=TKs5CC+IL2ohkDXFCrAcHck72rKRy7TNOASh6xQP2po=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DW00IftADjy1BRlqAm7JiWVI23hWtlIURk3SvIRzQ+D5ZvDnuPhh6yZdwng4hnH6w4qbsjVEsuIHZxk/kOOTGPzMk9DG32xGCxmmsA6JHdRSrvtlXt6NzyLCMQicorklC63GCi//2rQethgS0YHPe33Q8qcDL7T9h6vVnVYL5t8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XGKeAXT2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XGKeAXT2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6100DC4CEDD; Mon, 20 Jan 2025 11:19:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1737371995; bh=TKs5CC+IL2ohkDXFCrAcHck72rKRy7TNOASh6xQP2po=; h=From:To:Cc:Subject:Date:From; b=XGKeAXT24/nsIcATkdDXBZD9LP9kevWQRac5VyzoXXCgRgrMjvCFxasJhVlbXaWga jvjyabmpt0O84HMpi4xwbVUM0pif5Y4sNqpCje4nE2tKfICwGOsYoNMnqPYNsaUelT vW6rez16cOR31LiYG22+GKsJ9R7VVnQ05IBPPGWN/Vja9A1fValpcdozgrNiO3kRk5 aVDEHDkYt+b+XfYZGVBhxSMtKOHGLGChTj3deHXdUcYkzrgJuJ5N04bgr11aYD6otF gDrvJjGQKNdMsnijEaIuGUVThIBWsMHLPPFw7/e7m1G3Prr9P5e8NHHfgurdHOZn0h 8fiLKYXrSddfA== From: Chao Yu To: jaegeuk@kernel.org Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Chao Yu , syzbot+b9972806adbe20a910eb@syzkaller.appspotmail.com, liuderong Subject: [PATCH 1/2] f2fs: fix to avoid return invalid mtime from f2fs_get_section_mtime() Date: Mon, 20 Jan 2025 19:19:40 +0800 Message-ID: <20250120111941.191621-1-chao@kernel.org> X-Mailer: git-send-email 2.48.1.262.g85cc9f2d1e-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/gc.c:373! CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted 6.13.0-rc3-syzkaller-00044-gaef25be35d23 #0 RIP: 0010:get_cb_cost fs/f2fs/gc.c:373 [inline] RIP: 0010:get_gc_cost fs/f2fs/gc.c:406 [inline] RIP: 0010:f2fs_get_victim+0x68b1/0x6aa0 fs/f2fs/gc.c:912 Call Trace: __get_victim fs/f2fs/gc.c:1707 [inline] f2fs_gc+0xc89/0x2f60 fs/f2fs/gc.c:1915 f2fs_ioc_gc fs/f2fs/file.c:2624 [inline] __f2fs_ioctl+0x4cc9/0xb8b0 fs/f2fs/file.c:4482 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f w/ below testcase, it can reproduce directly: - dd if=/dev/zero of=/tmp/file bs=1M count=64 - mkfs.f2fs /tmp/file - mount -t f2fs -o loop,mode=fragment:block /tmp/file /mnt/f2fs - echo 0 > /sys/fs/f2fs/loop0/min_ssr_sections - dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=5 - umount /mnt/f2fs - for((i=4096;i<16384;i+=512)) do inject.f2fs --sit 0 --blk $i --mb mtime --val -1 /tmp/file; done - mount -o loop /tmp/file /mnt/f2fs - f2fs_io gc 0 /mnt/f2fs/file static unsigned int get_cb_cost() { ... mtime = f2fs_get_section_mtime(sbi, segno); f2fs_bug_on(sbi, mtime == INVALID_MTIME); ... } The root cause is: mtime in f2fs_sit_entry can be fuzzed to INVALID_MTIME, then it will trigger BUG_ON in get_cb_cost() during GC. Let's change behavior of f2fs_get_section_mtime() as below for fix: - return INVALID_MTIME only if total valid blocks is zero. - return INVALID_MTIME - 1 if average mtime calculated is INVALID_MTIME. Fixes: b19ee7272208 ("f2fs: introduce f2fs_get_section_mtime") Reported-by: syzbot+b9972806adbe20a910eb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/6768c82e.050a0220.226966.0035.GAE@google.com Cc: liuderong Signed-off-by: Chao Yu --- fs/f2fs/segment.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 813254dcc00e..b3a82a8cdc5f 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -5549,8 +5549,10 @@ unsigned long long f2fs_get_section_mtime(struct f2fs_sb_info *sbi, secno = GET_SEC_FROM_SEG(sbi, segno); start = GET_SEG_FROM_SEC(sbi, secno); - if (!__is_large_section(sbi)) - return get_seg_entry(sbi, start + i)->mtime; + if (!__is_large_section(sbi)) { + mtime = get_seg_entry(sbi, start + i)->mtime; + goto out; + } for (i = 0; i < usable_segs_per_sec; i++) { /* for large section, only check the mtime of valid segments */ @@ -5563,7 +5565,11 @@ unsigned long long f2fs_get_section_mtime(struct f2fs_sb_info *sbi, if (total_valid_blocks == 0) return INVALID_MTIME; - return div_u64(mtime, total_valid_blocks); + mtime = div_u64(mtime, total_valid_blocks); +out: + if (unlikely(mtime == INVALID_MTIME)) + mtime -= 1; + return mtime; } /* -- 2.48.1.262.g85cc9f2d1e-goog