f2fs: orphan entry pointing at an inode with no NAT entry triggers f2fs_bug_on() in recover_orphan_inode() - kernel BUG at mount with CONFIG_F2FS_CHECK_FS

f2fs: orphan entry pointing at an inode with no NAT entry triggers f2fs_bug_on() in recover_orphan_inode() - kernel BUG at mount with CONFIG_F2FS_CHECK_FS

[Guikun Yang]

Hi,

Mounting a crafted f2fs image ends in a kernel BUG during orphan inode
recovery, before any syscall beyond mount():

  kernel BUG at fs/f2fs/checkpoint.c:988!
  Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
  RIP: 0010:f2fs_recover_orphan_inodes+0xa1c/0xcb0
  Kernel panic - not syncing: Fatal exception

The BUG is in recover_orphan_inode() (fs/f2fs/checkpoint.c):

  inode = f2fs_iget_retry(sbi->sb, ino);
  if (IS_ERR(inode)) {
          /*
           * there should be a bug that we can't find the entry
           * to orphan inode.
           */
          f2fs_bug_on(sbi, PTR_ERR(inode) == -ENOENT);
          return PTR_ERR(inode);
  }

The comment assumes that reaching this branch means a kernel bug, but
the ino values come straight from the on-disk orphan area: the only
validation before the loop is an upper bound on entry_count, and the
ino[] array entries are never checked for existence. f2fs_iget()
resolves the ino through the NAT, and a NAT entry whose blk_addr is
NULL_ADDR makes it return -ENOENT (fs/f2fs/node.c). So an orphan entry
whose ino has no NAT entry - or has one freed to NULL_ADDR - walks
straight into the f2fs_bug_on() with no way for the mount to recover.

## The two configurations behave differently

Under CONFIG_F2FS_CHECK_FS this is BUG_ON, fatal at mount. Without it,
f2fs_bug_on() degrades to WARN_ON(1) + SBI_NEED_FSCK and recovery just
returns the error; the mount continues and the orphan is dropped after
"recover_orphan_inode: orphan failed (ino=%x), run fsck to fix." - the
orphan cleanup silently does not happen. The missing existence check
is the same in both configurations; only the reaction differs, and
neither reaction matches what the on-disk state can legitimately
contain after a crash on a fuzzed or corrupted image.

## Reproducer shape

The clean way to build it is to let f2fs write the orphan state
itself: mount, create a file, unlink() with the fd still open, sync()
to get a checkpoint with CP_ORPHAN_PRESENT_FLAG, then crash (sysrq-c).
That produces a self-consistent checkpoint with a real orphan area
(one block, entry_count 1, ino[0] = the unlinked file's ino). Then
only ino[0] is changed to an ino with no NAT entry, and the checkpoint
version is bumped with both checksums recomputed. Four payload bytes
plus version/checksum maintenance, nothing else.

Forging the orphan area layout by hand instead (e.g. rewriting
cp_pack_start_sum to grow the orphan region over the summary blocks)
breaks SIT/NAT journal lookup and the mount aborts before orphan
recovery - the self-written orphan state is what makes the target
reachable.

The reproducer (image builder, ready-made image, crash log) is
available on request. Tested on 7.3.0 with CONFIG_F2FS_CHECK_FS=y,
deterministic 3/3; the f2fs_bug_on() and the missing existence check
are unchanged in current mainline.

Thanks,
Guikun Yang

[PATCH] f2fs: don't BUG_ON a missing orphan inode at mount

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

recover_orphan_inode() treats -ENOENT from f2fs_iget() as a kernel
bug, but the ino comes from the on-disk orphan block. An image whose
orphan entry names an inode without a NAT entry hits the BUG_ON at
mount with CONFIG_F2FS_CHECK_FS, or a WARN and a failed mount
without it.

To reproduce, unlink a file while it is still open, sync, crash,
then change ino[0] in the checkpoint's orphan block to an unused
nid and mount:

  kernel BUG at fs/f2fs/checkpoint.c:967!
  RIP: 0010:f2fs_recover_orphan_inodes+0x6a3/0x9a0

Treat it as corruption, the same way the entry_count check does:
fail the mount with -EFSCORRUPTED and record
ERROR_INCONSISTENT_ORPHAN for fsck.

Fixes: 8c14bfadeac2 ("f2fs: handle error of f2fs_iget correctly")
Reported-by: Guikun Yang <yangguikun19@qq.com>
Closes: https://lore.kernel.org/linux-f2fs-devel/tencent_B30A444DF94444D1A63A7D6F8E2039F1990A@qq.com/
Cc: stable@kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
Tested in QEMU on f2fs/dev with CONFIG_F2FS_CHECK_FS=y:

  orphan ino   before            after
  4 (real)     mounts            mounts
  1000         BUG at mount      -EFSCORRUPTED, s_errors bit set

 fs/f2fs/checkpoint.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 1ed38c668fc5..e57904a33ff8 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -960,12 +960,13 @@ static int recover_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino)
 
 	inode = f2fs_iget_retry(sbi->sb, ino);
 	if (IS_ERR(inode)) {
-		/*
-		 * there should be a bug that we can't find the entry
-		 * to orphan inode.
-		 */
-		f2fs_bug_on(sbi, PTR_ERR(inode) == -ENOENT);
-		return PTR_ERR(inode);
+		if (PTR_ERR(inode) != -ENOENT)
+			return PTR_ERR(inode);
+		/* The orphan area lists an inode that does not exist. */
+		f2fs_err(sbi, "orphan inode %u does not exist", ino);
+		set_sbi_flag(sbi, SBI_NEED_FSCK);
+		f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
+		return -EFSCORRUPTED;
 	}
 
 	err = f2fs_dquot_initialize(inode);

base-commit: 9b12299b437e0cc3ebf402e7b36a89cc69151238
-- 
2.43.0