Go to file
Chao Yu a650654365 f2fs: fix to avoid out-of-boundary access in dnode page
[ Upstream commit 77de19b686 ]

As Jiaming Zhang reported:

 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x17e/0x800 mm/kasan/report.c:480
 kasan_report+0x147/0x180 mm/kasan/report.c:593
 data_blkaddr fs/f2fs/f2fs.h:3053 [inline]
 f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline]
 f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855
 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195
 prepare_write_begin fs/f2fs/data.c:3395 [inline]
 f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594
 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112
 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline]
 f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x546/0xa90 fs/read_write.c:686
 ksys_write+0x149/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The root cause is in the corrupted image, there is a dnode has the same
node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to
access block address in dnode at offset 934, however it parses the dnode
as inode node, so that get_dnode_addr() returns 360, then it tries to
access page address from 360 + 934 * 4 = 4096 w/ 4 bytes.

To fix this issue, let's add sanity check for node id of all direct nodes
during f2fs_get_dnode_of_data().

Cc: stable@kernel.org
Reported-by: Jiaming Zhang <r772577952@gmail.com>
Closes: https://groups.google.com/g/syzkaller/c/-ZnaaOOfO3M
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[ replaced f2fs_err_ratelimited() with f2fs_err() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:22:57 +02:00
arch mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() 2025-08-28 16:22:55 +02:00
block block: don't call rq_qos_ops->done_bio if the bio isn't tracked 2025-08-28 16:22:54 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:13:17 +02:00
crypto crypto: xts - Only add ecb if it is not already there 2025-06-27 11:04:01 +01:00
Documentation asm-generic: Add memory barrier dma_mb() 2025-08-28 16:22:57 +02:00
drivers media: qcom: camss: cleanup media device allocated resource on error path 2025-08-28 16:22:57 +02:00
fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:22:57 +02:00
include asm-generic: Add memory barrier dma_mb() 2025-08-28 16:22:57 +02:00
init bpf: Clean up sockmap related Kconfigs 2025-06-27 11:04:09 +01:00
io_uring io_uring: fix possible deadlock in io_register_iowq_max_workers() 2024-11-17 14:59:39 +01:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:04:14 +01:00
kernel mm: drop the assumption that VM_SHARED always implies writable 2025-08-28 16:22:54 +02:00
lib lib: test_objagg: Set error message in check_expect_hints_stats() 2025-07-17 18:27:47 +02:00
LICENSES
mm mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() 2025-08-28 16:22:55 +02:00
net net/sched: ets: use old 'nbands' while purging unused classes 2025-08-28 16:22:55 +02:00
samples samples: mei: Fix building on musl libc 2025-08-28 16:22:32 +02:00
scripts kconfig: lxdialog: fix 'space' to (de)select options 2025-08-28 16:22:47 +02:00
security securityfs: don't pin dentries twice, once is enough... 2025-08-28 16:22:40 +02:00
sound ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() 2025-08-28 16:22:53 +02:00
tools selftests/memfd: add test for mapping write-sealed memfd read-only 2025-08-28 16:22:55 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:04:11 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-10-22 15:39:24 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:07:59 +02:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS platform: Add Surface platform directory 2025-06-27 11:04:19 +01:00
Makefile kbuild: userprogs: use correct linker when mixing clang and GNU ld 2025-08-28 16:22:52 +02:00
README

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.