Chao Yu 901f62efd6 f2fs: fix to avoid out-of-boundary access in dnode page ... [ Upstream commit 77de19b686 ] As Jiaming Zhang reported: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data(). Cc: stable@kernel.org Reported-by: Jiaming Zhang <r772577952@gmail.com> Closes: https://groups.google.com/g/syzkaller/c/-ZnaaOOfO3M Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-28 16:26:15 +02:00
..
acl.c
acl.h
checkpoint.c	f2fs: fix to update user block counts in block_operations()	2024-08-03 08:49:48 +02:00
compress.c	f2fs: fix typos in comments	2024-06-12 11:03:37 +02:00
data.c	f2fs: fix to call clear_page_private_reference in .{release,invalid}_folio	2025-08-28 16:26:15 +02:00
debug.c
dir.c	f2fs: Introduce linear search for dentries	2025-02-21 13:49:25 +01:00
extent_cache.c	f2fs: fix KMSAN uninit-value in extent_info usage	2025-08-15 12:05:06 +02:00
f2fs.h	f2fs: fix to call clear_page_private_reference in .{release,invalid}_folio	2025-08-28 16:26:15 +02:00
file.c	f2fs: fix to wait dio completion	2025-02-21 13:50:12 +01:00
gc.c	f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID	2024-12-14 19:53:45 +01:00
gc.h
hash.c
inline.c	f2fs: Introduce linear search for dentries	2025-02-21 13:49:25 +01:00
inode.c	f2fs: fix to do sanity check on ino and xnid	2025-08-28 16:26:09 +02:00
iostat.c
iostat.h
Kconfig
Makefile
namei.c	f2fs: prevent kernel warning due to negative i_nlink from corrupted image	2025-06-27 11:07:29 +01:00
node.c	f2fs: fix to avoid out-of-boundary access in dnode page	2025-08-28 16:26:15 +02:00
node.h
recovery.c
segment.c	f2fs: check curseg->inited before write_sum_page in change_curseg	2024-12-14 19:53:45 +01:00
segment.h	f2fs: fix to calculate dirty data during has_not_enough_free_secs()	2025-08-15 12:05:07 +02:00
shrinker.c
super.c	f2fs: don't over-report free space or inodes in statvfs	2025-07-06 10:57:57 +02:00
sysfs.c	f2fs: check validation of fault attrs in f2fs_build_fault_attr()	2024-07-11 12:47:09 +02:00
verity.c
xattr.c	f2fs: reduce expensive checkpoint trigger frequency	2024-10-17 15:21:09 +02:00
xattr.h