* A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-19 7:13 ` butt3rflyh4ck
0 siblings, 0 replies; 11+ messages in thread
From: butt3rflyh4ck @ 2023-05-19 7:13 UTC (permalink / raw)
To: Jaegeuk Kim, chao; +Cc: linux-f2fs-devel, LKML
Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
fs/f2fs/data.c, I reproduce it in the latest kernel too.
#Quick description
When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
fs is failed, f2fs kernel thread would invoke callback function to
update
f2fs io info, it would call f2fs_write_end_io and may trigger
null-ptr-deref in NODE_MAPPING.
```
static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
{
return sbi->node_inode->i_mapping;
}
```
there is deref in sbi.
#crash log
----------------------------------------
general protection fault, probably for non-canonical address
0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
bio_endio+0x5af/0x6c0 block/bio.c:1608
req_bio_endio block/blk-mq.c:761 [inline]
blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
__do_softirq+0x1d4/0x8ef kernel/softirq.c:571
run_ksoftirqd kernel/softirq.c:939 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
kthread+0x33e/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
-----------------------
# new crash log in latest kernel
---------------------
[ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
[ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
valid(0xf2f52010) - read(0x0)
[ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
filesystem in 2th superblock
[ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
[ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
incorrect cp_ver (4542359912962316977, 0)
[ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
version = 3e17dab1
[ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
[ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
[ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
[ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
[ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
fsck to repair!
[ 193.780283][ C0] general protection fault, probably for
non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
[ 193.781027][ C0] KASAN: null-ptr-deref in range
[0x0000000000000030-0x0000000000000037]
[ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
[ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.15.0-1 04/01/2014
[ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[ 193.787055][ C0] FS: 0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[ 193.788585][ C0] Call Trace:
[ 193.788863][ C0] <TASK>
[ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
[ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
[ 193.790053][ C0] bio_endio+0x5af/0x6c0
[ 193.790522][ C0] blk_update_request+0x5cc/0x1690
[ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
[ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
[ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
[ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
[ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
[ 193.793805][ C0] run_ksoftirqd+0x31/0x60
[ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
[ 193.794576][ C0] ? sort_range+0x30/0x30
[ 193.794900][ C0] kthread+0x33e/0x440
[ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
[ 193.795907][ C0] ret_from_fork+0x1f/0x30
[ 193.796324][ C0] </TASK>
[ 193.796689][ C0] Modules linked in:
[ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
[ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[ 193.802069][ C0] FS: 0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 193.804748][ C0] Kernel Offset: disabled
[ 193.805086][ C0] Rebooting in 86400 seconds..
----------------------------
If needed, I would provide reproduce.
Regards,
butt3rflyh4ck.
--
Active Defense Lab of Venustech
^ permalink raw reply [flat|nested] 11+ messages in thread
* [f2fs-dev] A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-19 7:13 ` butt3rflyh4ck
0 siblings, 0 replies; 11+ messages in thread
From: butt3rflyh4ck @ 2023-05-19 7:13 UTC (permalink / raw)
To: Jaegeuk Kim, chao; +Cc: LKML, linux-f2fs-devel
Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
fs/f2fs/data.c, I reproduce it in the latest kernel too.
#Quick description
When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
fs is failed, f2fs kernel thread would invoke callback function to
update
f2fs io info, it would call f2fs_write_end_io and may trigger
null-ptr-deref in NODE_MAPPING.
```
static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
{
return sbi->node_inode->i_mapping;
}
```
there is deref in sbi.
#crash log
----------------------------------------
general protection fault, probably for non-canonical address
0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
bio_endio+0x5af/0x6c0 block/bio.c:1608
req_bio_endio block/blk-mq.c:761 [inline]
blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
__do_softirq+0x1d4/0x8ef kernel/softirq.c:571
run_ksoftirqd kernel/softirq.c:939 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
kthread+0x33e/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
PKRU: 55555554
-----------------------
# new crash log in latest kernel
---------------------
[ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
[ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
valid(0xf2f52010) - read(0x0)
[ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
filesystem in 2th superblock
[ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
[ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
incorrect cp_ver (4542359912962316977, 0)
[ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
version = 3e17dab1
[ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
[ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
[ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
[ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
[ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
fsck to repair!
[ 193.780283][ C0] general protection fault, probably for
non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
[ 193.781027][ C0] KASAN: null-ptr-deref in range
[0x0000000000000030-0x0000000000000037]
[ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
[ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.15.0-1 04/01/2014
[ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[ 193.787055][ C0] FS: 0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[ 193.788585][ C0] Call Trace:
[ 193.788863][ C0] <TASK>
[ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
[ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
[ 193.790053][ C0] bio_endio+0x5af/0x6c0
[ 193.790522][ C0] blk_update_request+0x5cc/0x1690
[ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
[ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
[ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
[ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
[ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
[ 193.793805][ C0] run_ksoftirqd+0x31/0x60
[ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
[ 193.794576][ C0] ? sort_range+0x30/0x30
[ 193.794900][ C0] kthread+0x33e/0x440
[ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
[ 193.795907][ C0] ret_from_fork+0x1f/0x30
[ 193.796324][ C0] </TASK>
[ 193.796689][ C0] Modules linked in:
[ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
[ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
[ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
[ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
[ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
RCX: 0000000000000100
[ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
RDI: 0000000000000030
[ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
R09: 0000000000000000
[ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
R12: ffffea000143e740
[ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
R15: 0000000000000000
[ 193.802069][ C0] FS: 0000000000000000(0000)
GS:ffff88802ca00000(0000) knlGS:0000000000000000
[ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
CR4: 00000000000006f0
[ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 193.804748][ C0] Kernel Offset: disabled
[ 193.805086][ C0] Rebooting in 86400 seconds..
----------------------------
If needed, I would provide reproduce.
Regards,
butt3rflyh4ck.
--
Active Defense Lab of Venustech
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: A null-ptr-deref bug in f2fs_write_end_io
2023-05-19 7:13 ` [f2fs-dev] " butt3rflyh4ck
@ 2023-05-19 15:24 ` Chao Yu
-1 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-19 15:24 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim
Hi,
Thanks for the report, it will be helpful if you can provide a
reproducer.
On 2023/5/19 15:13, butt3rflyh4ck wrote:
> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>
> #Quick description
> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
> fs is failed, f2fs kernel thread would invoke callback function to
> update
> f2fs io info, it would call f2fs_write_end_io and may trigger
> null-ptr-deref in NODE_MAPPING.
> ```
> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> {
> return sbi->node_inode->i_mapping;
> }
> ```
> there is deref in sbi.
>
> #crash log
> ----------------------------------------
> general protection fault, probably for non-canonical address
> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> bio_endio+0x5af/0x6c0 block/bio.c:1608
> req_bio_endio block/blk-mq.c:761 [inline]
> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> run_ksoftirqd kernel/softirq.c:939 [inline]
> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> kthread+0x33e/0x440 kernel/kthread.c:379
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> -----------------------
>
> # new crash log in latest kernel
> ---------------------
> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> valid(0xf2f52010) - read(0x0)
> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> filesystem in 2th superblock
> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> incorrect cp_ver (4542359912962316977, 0)
> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> version = 3e17dab1
> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> fsck to repair!
> [ 193.780283][ C0] general protection fault, probably for
> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> [ 193.781027][ C0] KASAN: null-ptr-deref in range
> [0x0000000000000030-0x0000000000000037]
> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [ 193.787055][ C0] FS: 0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [ 193.788585][ C0] Call Trace:
> [ 193.788863][ C0] <TASK>
> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
> [ 193.794576][ C0] ? sort_range+0x30/0x30
> [ 193.794900][ C0] kthread+0x33e/0x440
> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
> [ 193.796324][ C0] </TASK>
> [ 193.796689][ C0] Modules linked in:
> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [ 193.802069][ C0] FS: 0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
> [ 193.804748][ C0] Kernel Offset: disabled
> [ 193.805086][ C0] Rebooting in 86400 seconds..
> ----------------------------
>
> If needed, I would provide reproduce.
>
> Regards,
> butt3rflyh4ck.
>
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-19 15:24 ` Chao Yu
0 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-19 15:24 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: Jaegeuk Kim, LKML, linux-f2fs-devel
Hi,
Thanks for the report, it will be helpful if you can provide a
reproducer.
On 2023/5/19 15:13, butt3rflyh4ck wrote:
> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>
> #Quick description
> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
> fs is failed, f2fs kernel thread would invoke callback function to
> update
> f2fs io info, it would call f2fs_write_end_io and may trigger
> null-ptr-deref in NODE_MAPPING.
> ```
> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> {
> return sbi->node_inode->i_mapping;
> }
> ```
> there is deref in sbi.
>
> #crash log
> ----------------------------------------
> general protection fault, probably for non-canonical address
> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> bio_endio+0x5af/0x6c0 block/bio.c:1608
> req_bio_endio block/blk-mq.c:761 [inline]
> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> run_ksoftirqd kernel/softirq.c:939 [inline]
> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> kthread+0x33e/0x440 kernel/kthread.c:379
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> PKRU: 55555554
> -----------------------
>
> # new crash log in latest kernel
> ---------------------
> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> valid(0xf2f52010) - read(0x0)
> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> filesystem in 2th superblock
> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> incorrect cp_ver (4542359912962316977, 0)
> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> version = 3e17dab1
> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> fsck to repair!
> [ 193.780283][ C0] general protection fault, probably for
> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> [ 193.781027][ C0] KASAN: null-ptr-deref in range
> [0x0000000000000030-0x0000000000000037]
> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [ 193.787055][ C0] FS: 0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [ 193.788585][ C0] Call Trace:
> [ 193.788863][ C0] <TASK>
> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
> [ 193.794576][ C0] ? sort_range+0x30/0x30
> [ 193.794900][ C0] kthread+0x33e/0x440
> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
> [ 193.796324][ C0] </TASK>
> [ 193.796689][ C0] Modules linked in:
> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> RCX: 0000000000000100
> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> RDI: 0000000000000030
> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> R09: 0000000000000000
> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
> R12: ffffea000143e740
> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
> R15: 0000000000000000
> [ 193.802069][ C0] FS: 0000000000000000(0000)
> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> CR4: 00000000000006f0
> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
> [ 193.804748][ C0] Kernel Offset: disabled
> [ 193.805086][ C0] Rebooting in 86400 seconds..
> ----------------------------
>
> If needed, I would provide reproduce.
>
> Regards,
> butt3rflyh4ck.
>
>
>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: A null-ptr-deref bug in f2fs_write_end_io
2023-05-19 15:24 ` [f2fs-dev] " Chao Yu
(?)
@ 2023-05-22 3:58 ` butt3rflyh4ck
2023-05-22 12:44 ` [f2fs-dev] " Chao Yu
-1 siblings, 1 reply; 11+ messages in thread
From: butt3rflyh4ck @ 2023-05-22 3:58 UTC (permalink / raw)
To: Chao Yu; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim
[-- Attachment #1: Type: text/plain, Size: 9354 bytes --]
OK, the attachment is a reproducer.
Regards.
butt3rflyh4ck.
On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>
> Hi,
>
> Thanks for the report, it will be helpful if you can provide a
> reproducer.
>
> On 2023/5/19 15:13, butt3rflyh4ck wrote:
> > Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
> > fs/f2fs/data.c, I reproduce it in the latest kernel too.
> >
> > #Quick description
> > When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
> > fs is failed, f2fs kernel thread would invoke callback function to
> > update
> > f2fs io info, it would call f2fs_write_end_io and may trigger
> > null-ptr-deref in NODE_MAPPING.
> > ```
> > static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> > {
> > return sbi->node_inode->i_mapping;
> > }
> > ```
> > there is deref in sbi.
> >
> > #crash log
> > ----------------------------------------
> > general protection fault, probably for non-canonical address
> > 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> > KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> > CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> > RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> > Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> > 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> > 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> > RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> > RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> > RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> > R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> > FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > Call Trace:
> > <TASK>
> > bio_endio+0x5af/0x6c0 block/bio.c:1608
> > req_bio_endio block/blk-mq.c:761 [inline]
> > blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> > blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> > lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> > blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> > __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> > run_ksoftirqd kernel/softirq.c:939 [inline]
> > run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> > smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> > kthread+0x33e/0x440 kernel/kthread.c:379
> > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> > </TASK>
> > Modules linked in:
> > ---[ end trace 0000000000000000 ]---
> > RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> > RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> > Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> > 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> > 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> > RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> > RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> > RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> > R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> > FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > -----------------------
> >
> > # new crash log in latest kernel
> > ---------------------
> > [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> > [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> > valid(0xf2f52010) - read(0x0)
> > [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> > filesystem in 2th superblock
> > [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> > [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> > incorrect cp_ver (4542359912962316977, 0)
> > [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> > [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> > version = 3e17dab1
> > [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> > [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> > [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> > [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> > [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> > fsck to repair!
> > [ 193.780283][ C0] general protection fault, probably for
> > non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> > [ 193.781027][ C0] KASAN: null-ptr-deref in range
> > [0x0000000000000030-0x0000000000000037]
> > [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> > 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> > [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> > 1996), BIOS 1.15.0-1 04/01/2014
> > [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> > [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> > 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> > f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> > [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> > RCX: 0000000000000100
> > [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> > RDI: 0000000000000030
> > [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> > R09: 0000000000000000
> > [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
> > R12: ffffea000143e740
> > [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
> > R15: 0000000000000000
> > [ 193.787055][ C0] FS: 0000000000000000(0000)
> > GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> > CR4: 00000000000006f0
> > [ 193.788585][ C0] Call Trace:
> > [ 193.788863][ C0] <TASK>
> > [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
> > [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
> > [ 193.790053][ C0] bio_endio+0x5af/0x6c0
> > [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
> > [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
> > [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
> > [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
> > [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
> > [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
> > [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
> > [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
> > [ 193.794576][ C0] ? sort_range+0x30/0x30
> > [ 193.794900][ C0] kthread+0x33e/0x440
> > [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
> > [ 193.795907][ C0] ret_from_fork+0x1f/0x30
> > [ 193.796324][ C0] </TASK>
> > [ 193.796689][ C0] Modules linked in:
> > [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
> > [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> > [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> > 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> > f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> > [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> > [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> > RCX: 0000000000000100
> > [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> > RDI: 0000000000000030
> > [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> > R09: 0000000000000000
> > [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
> > R12: ffffea000143e740
> > [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
> > R15: 0000000000000000
> > [ 193.802069][ C0] FS: 0000000000000000(0000)
> > GS:ffff88802ca00000(0000) knlGS:0000000000000000
> > [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> > CR4: 00000000000006f0
> > [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
> > [ 193.804748][ C0] Kernel Offset: disabled
> > [ 193.805086][ C0] Rebooting in 86400 seconds..
> > ----------------------------
> >
> > If needed, I would provide reproduce.
> >
> > Regards,
> > butt3rflyh4ck.
> >
> >
> >
--
Active Defense Lab of Venustech
[-- Attachment #2: repro.cprog --]
[-- Type: application/octet-stream, Size: 18240 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/futex.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
struct fs_image_segment {
void* data;
uintptr_t size;
uintptr_t offset;
};
#define IMAGE_MAX_SEGMENTS 4096
#define IMAGE_MAX_SIZE (129 << 20)
static unsigned long fs_image_segment_check(unsigned long size,
unsigned long nsegs,
struct fs_image_segment* segs)
{
if (nsegs > IMAGE_MAX_SEGMENTS)
nsegs = IMAGE_MAX_SEGMENTS;
for (size_t i = 0; i < nsegs; i++) {
if (segs[i].size > IMAGE_MAX_SIZE)
segs[i].size = IMAGE_MAX_SIZE;
segs[i].offset %= IMAGE_MAX_SIZE;
if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size)
segs[i].offset = IMAGE_MAX_SIZE - segs[i].size;
if (size < segs[i].offset + segs[i].offset)
size = segs[i].offset + segs[i].offset;
}
if (size > IMAGE_MAX_SIZE)
size = IMAGE_MAX_SIZE;
return size;
}
static int setup_loop_device(long unsigned size, long unsigned nsegs,
struct fs_image_segment* segs,
const char* loopname, int* memfd_p, int* loopfd_p)
{
int err = 0, loopfd = -1;
size = fs_image_segment_check(size, nsegs, segs);
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (ftruncate(memfd, size)) {
err = errno;
goto error_close_memfd;
}
for (size_t i = 0; i < nsegs; i++) {
if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
}
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
*memfd_p = memfd;
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static long syz_mount_image(volatile long fsarg, volatile long dir,
volatile unsigned long size,
volatile unsigned long nsegs,
volatile long segments, volatile long flags,
volatile long optsarg, volatile long change_dir)
{
struct fs_image_segment* segs = (struct fs_image_segment*)segments;
int res = -1, err = 0, loopfd = -1, memfd = -1, need_loop_device = !!segs;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1)
return -1;
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
if (strstr(opts, "errors=panic") || strstr(opts, "errors=remount-ro") == 0)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
close(memfd);
}
errno = err;
return res;
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
retry:
while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void reset_loop()
{
char buf[64];
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
int loopfd = open(buf, O_RDWR);
if (loopfd != -1) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 3; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
if (call == 1)
break;
event_timedwait(&th->done,
50 + (call == 0 ? 50 : 0) + (call == 2 ? 50 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
memcpy((void*)0x20000000, "f2fs\000", 5);
memcpy((void*)0x20000100, "./file0\000", 8);
*(uint64_t*)0x20000200 = 0x20010000;
memcpy((void*)0x20010000,
"\x10\x20\xf5\xf2\x01\x00\x0e\x00\x09\x00\x00\x00\x03\x00\x00\x00"
"\x0c\x00\x00\x00\x09\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00"
"\x3e\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00"
"\x02\x00\x00\x00\x36\x00\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00"
"\x00\x08\x00\x00\x00\x0c\x00\x00\x00\x10\x00\x00\x00\x14\x00\x00"
"\x03\x00\x00\x00\x01\x00\x00\x00\x02",
105);
*(uint64_t*)0x20000208 = 0x69;
*(uint64_t*)0x20000210 = 0x400;
*(uint64_t*)0x20000218 = 0x20010740;
memcpy(
(void*)0x20010740,
"\xb1\xda\x17\x3e\x00\x00\x00\x00\x00\x24\x00\x00\x00\x00\x00\x00\x0b"
"\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x24\x00\x00\x00\x30\x00"
"\x00\x00\x34\x00\x00\x00\x32\x00\x00\x00\x30\x00\x00\x00\xff\xff\xff"
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
"\x03\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e"
"\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff"
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x05\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc5\x01\x00\x00"
"\x06\x00\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x07\x00\x00\x00\x0a"
"\x00\x00\x00\x40\x00\x00\x00\x40\x00\x00\x00\xfc\x0f",
166);
*(uint64_t*)0x20000220 = 0xa6;
*(uint64_t*)0x20000228 = 0x400000;
*(uint64_t*)0x20000230 = 0x20010800;
memcpy((void*)0x20010800,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\xb4\x09\x3f",
32);
*(uint64_t*)0x20000238 = 0x20;
*(uint64_t*)0x20000240 = 0x400fe0;
*(uint64_t*)0x20000248 = 0x20010840;
memcpy((void*)0x20010840,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06",
28);
*(uint64_t*)0x20000250 = 0x1c;
*(uint64_t*)0x20000258 = 0x4011e0;
*(uint64_t*)0x20000260 = 0x200108e0;
memcpy((void*)0x200108e0,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x32\x00\x00\x00\x05\x10\xec",
28);
*(uint64_t*)0x20000268 = 0x1c;
*(uint64_t*)0x20000270 = 0x401320;
*(uint64_t*)0x20000278 = 0x20010900;
memcpy((void*)0x20010900, "\x00\x00\x00\x34\x00\x00\x00\x02\x0c\x60", 10);
*(uint64_t*)0x20000280 = 0xa;
*(uint64_t*)0x20000288 = 0x401380;
*(uint64_t*)0x20000290 = 0x20010a20;
memcpy(
(void*)0x20010a20,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xb1\xda"
"\x17\x3e\x00\x00\x00\x00\x00\x24\x00\x00\x00\x00\x00\x00\x0b\x00\x00"
"\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x24\x00\x00\x00\x30\x00\x00\x00"
"\x34\x00\x00\x00\x32\x00\x00\x00\x30\x00\x00\x00\xff\xff\xff\xff\xff"
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x03\x00"
"\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00"
"\x00\x02\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff"
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x05\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc5\x01\x00\x00\x06\x00"
"\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x07\x00\x00\x00\x0a\x00\x00"
"\x00\x40\x00\x00\x00\x40\x00\x00\x00\xfc\x0f",
198);
*(uint64_t*)0x20000298 = 0xc6;
*(uint64_t*)0x200002a0 = 0x404fe0;
*(uint64_t*)0x200002a8 = 0x20010b00;
memcpy((void*)0x20010b00,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\xb4\x09\x3f",
32);
*(uint64_t*)0x200002b0 = 0x20;
*(uint64_t*)0x200002b8 = 0x405fe0;
*(uint64_t*)0x200002c0 = 0x20011000;
memcpy(
(void*)0x20011000,
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00"
"\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\x00\x03\x00\x00\x00\x01\x7c",
34);
*(uint64_t*)0x200002c8 = 0x22;
*(uint64_t*)0x200002d0 = 0xc00000;
*(uint64_t*)0x200002d8 = 0x20011a60;
memcpy((void*)0x20011a60,
"\xed\x41\x00\x00\x80\x76\x10\x00\x53\x5f\x01\x00\x03\x00\x00\x00"
"\x00\x10\x00\x00\x00\x00\x00\x00\x02",
25);
*(uint64_t*)0x200002e0 = 0x19;
*(uint64_t*)0x200002e8 = 0x7c01000;
*(uint64_t*)0x200002f0 = 0x20011ae0;
memcpy((void*)0x20011ae0,
"\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x03", 13);
*(uint64_t*)0x200002f8 = 0xd;
*(uint64_t*)0x20000300 = 0x7c01fe0;
res = -1;
res = syz_mount_image(0x20000000, 0x20000100, 0, 0xb, 0x20000200, 0,
0x20000040, 0);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x20000140 = 0x6000;
syscall(__NR_ioctl, r[0], 0x4008f510, 0x20000140ul);
break;
case 2:
memcpy((void*)0x20000580, "f2fs\000", 5);
memcpy((void*)0x20000080, "./file0\000", 8);
*(uint8_t*)0x200001c0 = 0;
syz_mount_image(0x20000580, 0x20000080, 0, 0, 0, 0x4a03f, 0x200001c0, 0);
break;
}
}
int main(void)
{
syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
use_temporary_dir();
loop();
return 0;
}
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: A null-ptr-deref bug in f2fs_write_end_io
2023-05-22 3:58 ` butt3rflyh4ck
@ 2023-05-22 12:44 ` Chao Yu
0 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-22 12:44 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim
On 2023/5/22 11:58, butt3rflyh4ck wrote:
> OK, the attachment is a reproducer.
Thank you!
I've figured out a patch, could you please have a try w/ this patch?
https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
Thanks,
>
> Regards.
> butt3rflyh4ck.
>
> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>
>> Hi,
>>
>> Thanks for the report, it will be helpful if you can provide a
>> reproducer.
>>
>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>
>>> #Quick description
>>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
>>> fs is failed, f2fs kernel thread would invoke callback function to
>>> update
>>> f2fs io info, it would call f2fs_write_end_io and may trigger
>>> null-ptr-deref in NODE_MAPPING.
>>> ```
>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>> {
>>> return sbi->node_inode->i_mapping;
>>> }
>>> ```
>>> there is deref in sbi.
>>>
>>> #crash log
>>> ----------------------------------------
>>> general protection fault, probably for non-canonical address
>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> Call Trace:
>>> <TASK>
>>> bio_endio+0x5af/0x6c0 block/bio.c:1608
>>> req_bio_endio block/blk-mq.c:761 [inline]
>>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>> run_ksoftirqd kernel/softirq.c:939 [inline]
>>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>> kthread+0x33e/0x440 kernel/kthread.c:379
>>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>> </TASK>
>>> Modules linked in:
>>> ---[ end trace 0000000000000000 ]---
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> -----------------------
>>>
>>> # new crash log in latest kernel
>>> ---------------------
>>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>> valid(0xf2f52010) - read(0x0)
>>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>> filesystem in 2th superblock
>>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>> incorrect cp_ver (4542359912962316977, 0)
>>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>> version = 3e17dab1
>>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>> fsck to repair!
>>> [ 193.780283][ C0] general protection fault, probably for
>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
>>> [0x0000000000000030-0x0000000000000037]
>>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>> 1996), BIOS 1.15.0-1 04/01/2014
>>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [ 193.787055][ C0] FS: 0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [ 193.788585][ C0] Call Trace:
>>> [ 193.788863][ C0] <TASK>
>>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
>>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
>>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
>>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
>>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
>>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
>>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
>>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
>>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
>>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
>>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
>>> [ 193.794576][ C0] ? sort_range+0x30/0x30
>>> [ 193.794900][ C0] kthread+0x33e/0x440
>>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
>>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
>>> [ 193.796324][ C0] </TASK>
>>> [ 193.796689][ C0] Modules linked in:
>>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
>>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [ 193.802069][ C0] FS: 0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
>>> [ 193.804748][ C0] Kernel Offset: disabled
>>> [ 193.805086][ C0] Rebooting in 86400 seconds..
>>> ----------------------------
>>>
>>> If needed, I would provide reproduce.
>>>
>>> Regards,
>>> butt3rflyh4ck.
>>>
>>>
>>>
>
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-22 12:44 ` Chao Yu
0 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-22 12:44 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: Jaegeuk Kim, LKML, linux-f2fs-devel
On 2023/5/22 11:58, butt3rflyh4ck wrote:
> OK, the attachment is a reproducer.
Thank you!
I've figured out a patch, could you please have a try w/ this patch?
https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
Thanks,
>
> Regards.
> butt3rflyh4ck.
>
> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>
>> Hi,
>>
>> Thanks for the report, it will be helpful if you can provide a
>> reproducer.
>>
>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>
>>> #Quick description
>>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
>>> fs is failed, f2fs kernel thread would invoke callback function to
>>> update
>>> f2fs io info, it would call f2fs_write_end_io and may trigger
>>> null-ptr-deref in NODE_MAPPING.
>>> ```
>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>> {
>>> return sbi->node_inode->i_mapping;
>>> }
>>> ```
>>> there is deref in sbi.
>>>
>>> #crash log
>>> ----------------------------------------
>>> general protection fault, probably for non-canonical address
>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> Call Trace:
>>> <TASK>
>>> bio_endio+0x5af/0x6c0 block/bio.c:1608
>>> req_bio_endio block/blk-mq.c:761 [inline]
>>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>> run_ksoftirqd kernel/softirq.c:939 [inline]
>>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>> kthread+0x33e/0x440 kernel/kthread.c:379
>>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>> </TASK>
>>> Modules linked in:
>>> ---[ end trace 0000000000000000 ]---
>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>> PKRU: 55555554
>>> -----------------------
>>>
>>> # new crash log in latest kernel
>>> ---------------------
>>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>> valid(0xf2f52010) - read(0x0)
>>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>> filesystem in 2th superblock
>>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>> incorrect cp_ver (4542359912962316977, 0)
>>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>> version = 3e17dab1
>>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>> fsck to repair!
>>> [ 193.780283][ C0] general protection fault, probably for
>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
>>> [0x0000000000000030-0x0000000000000037]
>>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>> 1996), BIOS 1.15.0-1 04/01/2014
>>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [ 193.787055][ C0] FS: 0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [ 193.788585][ C0] Call Trace:
>>> [ 193.788863][ C0] <TASK>
>>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
>>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
>>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
>>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
>>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
>>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
>>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
>>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
>>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
>>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
>>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
>>> [ 193.794576][ C0] ? sort_range+0x30/0x30
>>> [ 193.794900][ C0] kthread+0x33e/0x440
>>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
>>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
>>> [ 193.796324][ C0] </TASK>
>>> [ 193.796689][ C0] Modules linked in:
>>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
>>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>> RCX: 0000000000000100
>>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>> RDI: 0000000000000030
>>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>> R09: 0000000000000000
>>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
>>> R12: ffffea000143e740
>>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
>>> R15: 0000000000000000
>>> [ 193.802069][ C0] FS: 0000000000000000(0000)
>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>> CR4: 00000000000006f0
>>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
>>> [ 193.804748][ C0] Kernel Offset: disabled
>>> [ 193.805086][ C0] Rebooting in 86400 seconds..
>>> ----------------------------
>>>
>>> If needed, I would provide reproduce.
>>>
>>> Regards,
>>> butt3rflyh4ck.
>>>
>>>
>>>
>
>
>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: A null-ptr-deref bug in f2fs_write_end_io
2023-05-22 12:44 ` [f2fs-dev] " Chao Yu
@ 2023-05-22 14:20 ` butt3rflyh4ck
-1 siblings, 0 replies; 11+ messages in thread
From: butt3rflyh4ck @ 2023-05-22 14:20 UTC (permalink / raw)
To: Chao Yu; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim
I have tested the patch, it works fine.
Regards,
butt3rflyh4ck.
On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>
> On 2023/5/22 11:58, butt3rflyh4ck wrote:
> > OK, the attachment is a reproducer.
>
> Thank you!
>
> I've figured out a patch, could you please have a try w/ this patch?
>
> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>
> Thanks,
>
> >
> > Regards.
> > butt3rflyh4ck.
> >
> > On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
> >>
> >> Hi,
> >>
> >> Thanks for the report, it will be helpful if you can provide a
> >> reproducer.
> >>
> >> On 2023/5/19 15:13, butt3rflyh4ck wrote:
> >>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
> >>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
> >>>
> >>> #Quick description
> >>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
> >>> fs is failed, f2fs kernel thread would invoke callback function to
> >>> update
> >>> f2fs io info, it would call f2fs_write_end_io and may trigger
> >>> null-ptr-deref in NODE_MAPPING.
> >>> ```
> >>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> >>> {
> >>> return sbi->node_inode->i_mapping;
> >>> }
> >>> ```
> >>> there is deref in sbi.
> >>>
> >>> #crash log
> >>> ----------------------------------------
> >>> general protection fault, probably for non-canonical address
> >>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> >>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> Call Trace:
> >>> <TASK>
> >>> bio_endio+0x5af/0x6c0 block/bio.c:1608
> >>> req_bio_endio block/blk-mq.c:761 [inline]
> >>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> >>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> >>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> >>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> >>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> >>> run_ksoftirqd kernel/softirq.c:939 [inline]
> >>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> >>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> >>> kthread+0x33e/0x440 kernel/kthread.c:379
> >>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> >>> </TASK>
> >>> Modules linked in:
> >>> ---[ end trace 0000000000000000 ]---
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> -----------------------
> >>>
> >>> # new crash log in latest kernel
> >>> ---------------------
> >>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> >>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> >>> valid(0xf2f52010) - read(0x0)
> >>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> >>> filesystem in 2th superblock
> >>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> >>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> >>> incorrect cp_ver (4542359912962316977, 0)
> >>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> >>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> >>> version = 3e17dab1
> >>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> >>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> >>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> >>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> >>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> >>> fsck to repair!
> >>> [ 193.780283][ C0] general protection fault, probably for
> >>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
> >>> [0x0000000000000030-0x0000000000000037]
> >>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> >>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> >>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >>> 1996), BIOS 1.15.0-1 04/01/2014
> >>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [ 193.787055][ C0] FS: 0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [ 193.788585][ C0] Call Trace:
> >>> [ 193.788863][ C0] <TASK>
> >>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
> >>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
> >>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
> >>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
> >>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
> >>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
> >>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
> >>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
> >>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
> >>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
> >>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
> >>> [ 193.794576][ C0] ? sort_range+0x30/0x30
> >>> [ 193.794900][ C0] kthread+0x33e/0x440
> >>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
> >>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
> >>> [ 193.796324][ C0] </TASK>
> >>> [ 193.796689][ C0] Modules linked in:
> >>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
> >>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [ 193.802069][ C0] FS: 0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
> >>> [ 193.804748][ C0] Kernel Offset: disabled
> >>> [ 193.805086][ C0] Rebooting in 86400 seconds..
> >>> ----------------------------
> >>>
> >>> If needed, I would provide reproduce.
> >>>
> >>> Regards,
> >>> butt3rflyh4ck.
> >>>
> >>>
> >>>
> >
> >
> >
--
Active Defense Lab of Venustech
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-22 14:20 ` butt3rflyh4ck
0 siblings, 0 replies; 11+ messages in thread
From: butt3rflyh4ck @ 2023-05-22 14:20 UTC (permalink / raw)
To: Chao Yu; +Cc: Jaegeuk Kim, LKML, linux-f2fs-devel
I have tested the patch, it works fine.
Regards,
butt3rflyh4ck.
On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>
> On 2023/5/22 11:58, butt3rflyh4ck wrote:
> > OK, the attachment is a reproducer.
>
> Thank you!
>
> I've figured out a patch, could you please have a try w/ this patch?
>
> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>
> Thanks,
>
> >
> > Regards.
> > butt3rflyh4ck.
> >
> > On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
> >>
> >> Hi,
> >>
> >> Thanks for the report, it will be helpful if you can provide a
> >> reproducer.
> >>
> >> On 2023/5/19 15:13, butt3rflyh4ck wrote:
> >>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
> >>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
> >>>
> >>> #Quick description
> >>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
> >>> fs is failed, f2fs kernel thread would invoke callback function to
> >>> update
> >>> f2fs io info, it would call f2fs_write_end_io and may trigger
> >>> null-ptr-deref in NODE_MAPPING.
> >>> ```
> >>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
> >>> {
> >>> return sbi->node_inode->i_mapping;
> >>> }
> >>> ```
> >>> there is deref in sbi.
> >>>
> >>> #crash log
> >>> ----------------------------------------
> >>> general protection fault, probably for non-canonical address
> >>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> >>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
> >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> Call Trace:
> >>> <TASK>
> >>> bio_endio+0x5af/0x6c0 block/bio.c:1608
> >>> req_bio_endio block/blk-mq.c:761 [inline]
> >>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
> >>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
> >>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
> >>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
> >>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
> >>> run_ksoftirqd kernel/softirq.c:939 [inline]
> >>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
> >>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
> >>> kthread+0x33e/0x440 kernel/kthread.c:379
> >>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
> >>> </TASK>
> >>> Modules linked in:
> >>> ---[ end trace 0000000000000000 ]---
> >>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
> >>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
> >>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
> >>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
> >>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
> >>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
> >>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
> >>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
> >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
> >>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
> >>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
> >>> PKRU: 55555554
> >>> -----------------------
> >>>
> >>> # new crash log in latest kernel
> >>> ---------------------
> >>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
> >>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
> >>> valid(0xf2f52010) - read(0x0)
> >>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
> >>> filesystem in 2th superblock
> >>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
> >>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
> >>> incorrect cp_ver (4542359912962316977, 0)
> >>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
> >>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
> >>> version = 3e17dab1
> >>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
> >>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
> >>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
> >>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
> >>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
> >>> fsck to repair!
> >>> [ 193.780283][ C0] general protection fault, probably for
> >>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
> >>> [0x0000000000000030-0x0000000000000037]
> >>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
> >>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
> >>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >>> 1996), BIOS 1.15.0-1 04/01/2014
> >>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [ 193.787055][ C0] FS: 0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [ 193.788585][ C0] Call Trace:
> >>> [ 193.788863][ C0] <TASK>
> >>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
> >>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
> >>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
> >>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
> >>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
> >>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
> >>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
> >>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
> >>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
> >>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
> >>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
> >>> [ 193.794576][ C0] ? sort_range+0x30/0x30
> >>> [ 193.794900][ C0] kthread+0x33e/0x440
> >>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
> >>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
> >>> [ 193.796324][ C0] </TASK>
> >>> [ 193.796689][ C0] Modules linked in:
> >>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
> >>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
> >>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
> >>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
> >>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
> >>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
> >>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
> >>> RCX: 0000000000000100
> >>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
> >>> RDI: 0000000000000030
> >>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
> >>> R09: 0000000000000000
> >>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
> >>> R12: ffffea000143e740
> >>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
> >>> R15: 0000000000000000
> >>> [ 193.802069][ C0] FS: 0000000000000000(0000)
> >>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
> >>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
> >>> CR4: 00000000000006f0
> >>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
> >>> [ 193.804748][ C0] Kernel Offset: disabled
> >>> [ 193.805086][ C0] Rebooting in 86400 seconds..
> >>> ----------------------------
> >>>
> >>> If needed, I would provide reproduce.
> >>>
> >>> Regards,
> >>> butt3rflyh4ck.
> >>>
> >>>
> >>>
> >
> >
> >
--
Active Defense Lab of Venustech
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] A null-ptr-deref bug in f2fs_write_end_io
2023-05-22 14:20 ` [f2fs-dev] " butt3rflyh4ck
@ 2023-05-23 1:01 ` Chao Yu
-1 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-23 1:01 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: Jaegeuk Kim, LKML, linux-f2fs-devel
On 2023/5/22 22:20, butt3rflyh4ck wrote:
> I have tested the patch, it works fine.
Thank you, I'd like to add below tag in the patch if you don't mind.
Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Thanks,
>
>
> Regards,
> butt3rflyh4ck.
>
> On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>>
>> On 2023/5/22 11:58, butt3rflyh4ck wrote:
>>> OK, the attachment is a reproducer.
>>
>> Thank you!
>>
>> I've figured out a patch, could you please have a try w/ this patch?
>>
>> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>>
>> Thanks,
>>
>>>
>>> Regards.
>>> butt3rflyh4ck.
>>>
>>> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for the report, it will be helpful if you can provide a
>>>> reproducer.
>>>>
>>>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>>>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
>>>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>>>
>>>>> #Quick description
>>>>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
>>>>> fs is failed, f2fs kernel thread would invoke callback function to
>>>>> update
>>>>> f2fs io info, it would call f2fs_write_end_io and may trigger
>>>>> null-ptr-deref in NODE_MAPPING.
>>>>> ```
>>>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>>>> {
>>>>> return sbi->node_inode->i_mapping;
>>>>> }
>>>>> ```
>>>>> there is deref in sbi.
>>>>>
>>>>> #crash log
>>>>> ----------------------------------------
>>>>> general protection fault, probably for non-canonical address
>>>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> Call Trace:
>>>>> <TASK>
>>>>> bio_endio+0x5af/0x6c0 block/bio.c:1608
>>>>> req_bio_endio block/blk-mq.c:761 [inline]
>>>>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>>>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>>>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>>>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>>>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>>>> run_ksoftirqd kernel/softirq.c:939 [inline]
>>>>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>>>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>>>> kthread+0x33e/0x440 kernel/kthread.c:379
>>>>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>>>> </TASK>
>>>>> Modules linked in:
>>>>> ---[ end trace 0000000000000000 ]---
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> -----------------------
>>>>>
>>>>> # new crash log in latest kernel
>>>>> ---------------------
>>>>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>>>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>>>> valid(0xf2f52010) - read(0x0)
>>>>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>>>> filesystem in 2th superblock
>>>>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>>>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>>>> incorrect cp_ver (4542359912962316977, 0)
>>>>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>>>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>>>> version = 3e17dab1
>>>>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>>>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>>>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>>>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>>>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>>>> fsck to repair!
>>>>> [ 193.780283][ C0] general protection fault, probably for
>>>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
>>>>> [0x0000000000000030-0x0000000000000037]
>>>>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>>>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>>>> 1996), BIOS 1.15.0-1 04/01/2014
>>>>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [ 193.787055][ C0] FS: 0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [ 193.788585][ C0] Call Trace:
>>>>> [ 193.788863][ C0] <TASK>
>>>>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
>>>>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
>>>>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
>>>>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
>>>>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
>>>>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
>>>>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
>>>>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
>>>>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
>>>>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
>>>>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
>>>>> [ 193.794576][ C0] ? sort_range+0x30/0x30
>>>>> [ 193.794900][ C0] kthread+0x33e/0x440
>>>>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
>>>>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
>>>>> [ 193.796324][ C0] </TASK>
>>>>> [ 193.796689][ C0] Modules linked in:
>>>>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
>>>>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [ 193.802069][ C0] FS: 0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
>>>>> [ 193.804748][ C0] Kernel Offset: disabled
>>>>> [ 193.805086][ C0] Rebooting in 86400 seconds..
>>>>> ----------------------------
>>>>>
>>>>> If needed, I would provide reproduce.
>>>>>
>>>>> Regards,
>>>>> butt3rflyh4ck.
>>>>>
>>>>>
>>>>>
>>>
>>>
>>>
>
>
>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: A null-ptr-deref bug in f2fs_write_end_io
@ 2023-05-23 1:01 ` Chao Yu
0 siblings, 0 replies; 11+ messages in thread
From: Chao Yu @ 2023-05-23 1:01 UTC (permalink / raw)
To: butt3rflyh4ck; +Cc: linux-f2fs-devel, LKML, Jaegeuk Kim
On 2023/5/22 22:20, butt3rflyh4ck wrote:
> I have tested the patch, it works fine.
Thank you, I'd like to add below tag in the patch if you don't mind.
Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Thanks,
>
>
> Regards,
> butt3rflyh4ck.
>
> On Mon, May 22, 2023 at 8:44 PM Chao Yu <chao@kernel.org> wrote:
>>
>> On 2023/5/22 11:58, butt3rflyh4ck wrote:
>>> OK, the attachment is a reproducer.
>>
>> Thank you!
>>
>> I've figured out a patch, could you please have a try w/ this patch?
>>
>> https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/
>>
>> Thanks,
>>
>>>
>>> Regards.
>>> butt3rflyh4ck.
>>>
>>> On Fri, May 19, 2023 at 11:24 PM Chao Yu <chao@kernel.org> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for the report, it will be helpful if you can provide a
>>>> reproducer.
>>>>
>>>> On 2023/5/19 15:13, butt3rflyh4ck wrote:
>>>>> Hi, there is a null-ptr-deref bug in f2fs_write_end_io in
>>>>> fs/f2fs/data.c, I reproduce it in the latest kernel too.
>>>>>
>>>>> #Quick description
>>>>> When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize
>>>>> fs is failed, f2fs kernel thread would invoke callback function to
>>>>> update
>>>>> f2fs io info, it would call f2fs_write_end_io and may trigger
>>>>> null-ptr-deref in NODE_MAPPING.
>>>>> ```
>>>>> static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
>>>>> {
>>>>> return sbi->node_inode->i_mapping;
>>>>> }
>>>>> ```
>>>>> there is deref in sbi.
>>>>>
>>>>> #crash log
>>>>> ----------------------------------------
>>>>> general protection fault, probably for non-canonical address
>>>>> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>>>>> CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1 #18
>>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> Call Trace:
>>>>> <TASK>
>>>>> bio_endio+0x5af/0x6c0 block/bio.c:1608
>>>>> req_bio_endio block/blk-mq.c:761 [inline]
>>>>> blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
>>>>> blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
>>>>> lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
>>>>> blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
>>>>> __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
>>>>> run_ksoftirqd kernel/softirq.c:939 [inline]
>>>>> run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
>>>>> smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
>>>>> kthread+0x33e/0x440 kernel/kthread.c:379
>>>>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>>>>> </TASK>
>>>>> Modules linked in:
>>>>> ---[ end trace 0000000000000000 ]---
>>>>> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
>>>>> RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
>>>>> Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 b3 07 00 00 48 8b
>>>>> 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89 f8 48 c1 e8 03 <80> 3c
>>>>> 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 84 10 04 00 00 e8 10
>>>>> RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> RAX: 0000000000000006 RBX: dffffc0000000000 RCX: 0000000000000100
>>>>> RDX: ffff888013d18000 RSI: ffffffff83a93a4d RDI: 0000000000000030
>>>>> RBP: ffffea00009e6900 R08: 0000000000000001 R09: 0000000000000000
>>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00009e6900
>>>>> R13: 0000000000000000 R14: ffff88802a3cec48 R15: 0000000000000000
>>>>> FS: 0000000000000000(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000555faf194000 CR3: 00000000251bd000 CR4: 0000000000750ef0
>>>>> PKRU: 55555554
>>>>> -----------------------
>>>>>
>>>>> # new crash log in latest kernel
>>>>> ---------------------
>>>>> [ 193.695164][ T8174] loop0: detected capacity change from 0 to 264192
>>>>> [ 193.696467][ T8174] F2FS-fs (loop0): Magic Mismatch,
>>>>> valid(0xf2f52010) - read(0x0)
>>>>> [ 193.696875][ T8174] F2FS-fs (loop0): Can't find valid F2FS
>>>>> filesystem in 2th superblock
>>>>> [ 193.698363][ T8174] F2FS-fs (loop0): invalid crc_offset: 0
>>>>> [ 193.700454][ T8174] F2FS-fs (loop0): Disable nat_bits due to
>>>>> incorrect cp_ver (4542359912962316977, 0)
>>>>> [ 193.716594][ T8174] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
>>>>> [ 193.717102][ T8174] F2FS-fs (loop0): Mounted with checkpoint
>>>>> version = 3e17dab1
>>>>> [ 193.743330][ T8174] F2FS-fs (loop0): For resize: curseg of type 0: 46 ==> 4
>>>>> [ 193.743904][ T8174] F2FS-fs (loop0): For resize: curseg of type 3: 52 ==> 6
>>>>> [ 193.745690][ T8174] F2FS-fs (loop0): For resize: curseg of type 4: 50 ==> 8
>>>>> [ 193.746108][ T8174] F2FS-fs (loop0): For resize: curseg of type 5: 48 ==> 10
>>>>> [ 193.751857][ T8174] F2FS-fs (loop0): resize_fs failed, should run
>>>>> fsck to repair!
>>>>> [ 193.780283][ C0] general protection fault, probably for
>>>>> non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>>>>> [ 193.781027][ C0] KASAN: null-ptr-deref in range
>>>>> [0x0000000000000030-0x0000000000000037]
>>>>> [ 193.781572][ C0] CPU: 0 PID: 17 Comm: ksoftirqd/0 Not tainted
>>>>> 6.4.0-rc2-00163-g2d1bcbc6cd70-dirty #17
>>>>> [ 193.782201][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX,
>>>>> 1996), BIOS 1.15.0-1 04/01/2014
>>>>> [ 193.782727][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [ 193.783083][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [ 193.784268][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [ 193.784629][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [ 193.785109][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [ 193.785576][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [ 193.786051][ C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [ 193.786571][ C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [ 193.787055][ C0] FS: 0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [ 193.787620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [ 193.787997][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [ 193.788585][ C0] Call Trace:
>>>>> [ 193.788863][ C0] <TASK>
>>>>> [ 193.789115][ C0] ? bio_uninit+0x1b7/0x410
>>>>> [ 193.789509][ C0] ? f2fs_write_end+0xa80/0xa80
>>>>> [ 193.790053][ C0] bio_endio+0x5af/0x6c0
>>>>> [ 193.790522][ C0] blk_update_request+0x5cc/0x1690
>>>>> [ 193.791171][ C0] blk_mq_end_request+0x59/0x4c0
>>>>> [ 193.791695][ C0] lo_complete_rq+0x1c6/0x280
>>>>> [ 193.792247][ C0] blk_complete_reqs+0xad/0xe0
>>>>> [ 193.792759][ C0] __do_softirq+0x1d4/0x8ef
>>>>> [ 193.793312][ C0] ? __irq_exit_rcu+0x190/0x190
>>>>> [ 193.793805][ C0] run_ksoftirqd+0x31/0x60
>>>>> [ 193.794183][ C0] smpboot_thread_fn+0x659/0x9e0
>>>>> [ 193.794576][ C0] ? sort_range+0x30/0x30
>>>>> [ 193.794900][ C0] kthread+0x33e/0x440
>>>>> [ 193.795263][ C0] ? kthread_complete_and_exit+0x40/0x40
>>>>> [ 193.795907][ C0] ret_from_fork+0x1f/0x30
>>>>> [ 193.796324][ C0] </TASK>
>>>>> [ 193.796689][ C0] Modules linked in:
>>>>> [ 193.797189][ C0] ---[ end trace 0000000000000000 ]---
>>>>> [ 193.797635][ C0] RIP: 0010:f2fs_write_end_io+0x727/0x1050
>>>>> [ 193.798182][ C0] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f
>>>>> 85 b3 07 00 00 48 8b 44 24 08 4c 8b a8 60 01 00 00 49 8d 7d 30 48 89
>>>>> f8 48 c1 e8 03 <80> 3c 18 00 0f 85 9c 07 00 00 4d 3b 75 30 0f 0
>>>>> [ 193.799559][ C0] RSP: 0018:ffffc9000042fc78 EFLAGS: 00010216
>>>>> [ 193.799945][ C0] RAX: 0000000000000006 RBX: dffffc0000000000
>>>>> RCX: 0000000000000100
>>>>> [ 193.800329][ C0] RDX: ffff888013d18000 RSI: ffffffff83a9588d
>>>>> RDI: 0000000000000030
>>>>> [ 193.800666][ C0] RBP: ffffea000143e740 R08: 0000000000000001
>>>>> R09: 0000000000000000
>>>>> [ 193.801047][ C0] R10: 0000000000000000 R11: 0000000000000000
>>>>> R12: ffffea000143e740
>>>>> [ 193.801503][ C0] R13: 0000000000000000 R14: ffff888041423738
>>>>> R15: 0000000000000000
>>>>> [ 193.802069][ C0] FS: 0000000000000000(0000)
>>>>> GS:ffff88802ca00000(0000) knlGS:0000000000000000
>>>>> [ 193.802804][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> [ 193.803356][ C0] CR2: 000056056fd87000 CR3: 000000001b546000
>>>>> CR4: 00000000000006f0
>>>>> [ 193.804046][ C0] Kernel panic - not syncing: Fatal exception in interrupt
>>>>> [ 193.804748][ C0] Kernel Offset: disabled
>>>>> [ 193.805086][ C0] Rebooting in 86400 seconds..
>>>>> ----------------------------
>>>>>
>>>>> If needed, I would provide reproduce.
>>>>>
>>>>> Regards,
>>>>> butt3rflyh4ck.
>>>>>
>>>>>
>>>>>
>>>
>>>
>>>
>
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2023-05-23 1:03 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-19 7:13 A null-ptr-deref bug in f2fs_write_end_io butt3rflyh4ck
2023-05-19 7:13 ` [f2fs-dev] " butt3rflyh4ck
2023-05-19 15:24 ` Chao Yu
2023-05-19 15:24 ` [f2fs-dev] " Chao Yu
2023-05-22 3:58 ` butt3rflyh4ck
2023-05-22 12:44 ` Chao Yu
2023-05-22 12:44 ` [f2fs-dev] " Chao Yu
2023-05-22 14:20 ` butt3rflyh4ck
2023-05-22 14:20 ` [f2fs-dev] " butt3rflyh4ck
2023-05-23 1:01 ` Chao Yu
2023-05-23 1:01 ` Chao Yu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.