summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-03-13f2fs: pass sbi rather than sb to parse_options()Eric Sandeen
With the new mount API the sb will not be available during initial option parsing, which will happen before fill_super reads sb from disk. Now that the sb is no longer directly referenced in parse_options, switch it to use sbi. (Note that all calls to f2fs_sb_has_* originating from parse_options will need to be deferred to later before we can use the new mount API.) Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: pass sbi rather than sb to quota qf_name helpersEric Sandeen
With the new mount api we will not have the superblock available during option parsing. Prepare for this by passing *sbi rather than *sb. For now, we are parsing after fill_super has been done, so sbi->sb will exist. Under the new mount API this will require more care, but do the simple change for now. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: defer readonly check vs norecoveryEric Sandeen
Defer the readonly-vs-norecovery check until after option parsing is done so that option parsing does not require an active superblock for the test. Add a helpful message, while we're at it. (I think could be moved back into parsing after we switch to the new mount API if desired, as the fs context will have RO state available.) Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: Pass sbi rather than sb to f2fs_set_test_dummy_encryptionEric Sandeen
This removes another sb instance from parse_options() Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: make LAZYTIME a mount option flagEric Sandeen
Set LAZYTIME into sbi during parsing, and transfer it to the sb in fill_super, so that an sb is not required during option parsing. (Note: While lazytime is normally handled via mount flag in the vfs, some f2fs users do expect to be able to use it as an explicit mount option string via the mount syscall, so this option must remain.) Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: make INLINECRYPT a mount option flagEric Sandeen
Set INLINECRYPT into sbi during parsing, and transfer it to the sb in fill_super, so that an sb is not required during option parsing. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: factor out an f2fs_default_check functionEric Sandeen
The current options parsing function both parses options and validates them - factor the validation out to reduce the size of the function and make transition to the new mount API possible, because under the new mount API, options are parsed one at a time, and cannot all be tested at the end of the parsing function. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: consolidate unsupported option handling errorsEric Sandeen
When certain build-time options are disabled, some mount options are not accepted. For quota and compression, all related options are dismissed with a single error message. For xattr, acl, and fault injection, each option is handled individually. In addition, inline_xattr_size was missed when CONFIG_F2FS_FS_XATTR was disabled. Collapse xattr, acl, and fault injection errors into a single string, for simplicity, and handle the missing inline_xattr_size case. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: use f2fs_sb_has_device_alias during option parsingEric Sandeen
Rather than using F2FS_HAS_FEATURE directly, use f2fs_sb_has_device_alias macro during option parsing for consistency. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-13f2fs: add carve_out sysfs nodeDaeho Jeong
For several zoned storage devices, vendors will provide extra space which was used for device level GC than specs and F2FS can use this space for filesystem level GC. To do that, we can reserve the space using reserved_blocks. However, it is not enough, since this extra space should not be shown to users. So, with this new sysfs node, we can hide the space by substracting reserved_blocks from total bytes. Signed-off-by: Daeho Jeong <daehojeong@google.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-12f2fs: fix to avoid running out of free segmentsChao Yu
If checkpoint is disabled, GC can not reclaim any segments, we need to detect such condition and bail out from fallocate() of a pinfile, rather than letting allocator running out of free segment, which may cause f2fs to be shutdown. reproducer: mkfs.f2fs -f /dev/vda 16777216 mount -o checkpoint=disable:10% /dev/vda /mnt/f2fs for ((i=0;i<4096;i++)) do { dd if=/dev/zero of=/mnt/f2fs/$i bs=1M count=1; } done sync for ((i=0;i<4096;i+=2)) do { rm /mnt/f2fs/$i; } done sync touch /mnt/f2fs/pinfile f2fs_io pinfile set /mnt/f2fs/pinfile f2fs_io fallocate 0 0 4201644032 /mnt/f2fs/pinfile cat /sys/kernel/debug/f2fs/status output: - Free: 0 (0) Fixes: f5a53edcf01e ("f2fs: support aligned pinned file") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: Remove f2fs_write_node_page()Matthew Wilcox (Oracle)
Mappings which implement writepages should not implement writepage as it can only harm writeback patterns. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: Remove f2fs_write_meta_page()Matthew Wilcox (Oracle)
Mappings which implement writepages should not implement writepage as it can only harm writeback patterns. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: Remove f2fs_write_data_page()Matthew Wilcox (Oracle)
Mappings which implement writepages should not implement writepage as it can only harm writeback patterns. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: Remove check for ->writepageMatthew Wilcox (Oracle)
We're almost able to remove a_ops->writepage. This check is unnecessary as we'll never call into __f2fs_write_data_pages() for character devices. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11Revert "f2fs: rebuild nat_bits during umount"Chao Yu
This reverts commit 94c821fb286b545d37549ff30a0c341e066f0d6c. It reports that there is potential corruption in node footer, the most suspious feature is nat_bits, let's revert recovery related code. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: fix to avoid accessing uninitialized cursegChao Yu
syzbot reports a f2fs bug as below: F2FS-fs (loop3): Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device BUG: unable to handle page fault for address: ffffed1604ea3dfa RIP: 0010:get_ckpt_valid_blocks fs/f2fs/segment.h:361 [inline] RIP: 0010:has_curseg_enough_space fs/f2fs/segment.h:570 [inline] RIP: 0010:__get_secs_required fs/f2fs/segment.h:620 [inline] RIP: 0010:has_not_enough_free_secs fs/f2fs/segment.h:633 [inline] RIP: 0010:has_enough_free_secs+0x575/0x1660 fs/f2fs/segment.h:649 <TASK> f2fs_is_checkpoint_ready fs/f2fs/segment.h:671 [inline] f2fs_write_inode+0x425/0x540 fs/f2fs/inode.c:791 write_inode fs/fs-writeback.c:1525 [inline] __writeback_single_inode+0x708/0x10d0 fs/fs-writeback.c:1745 writeback_sb_inodes+0x820/0x1360 fs/fs-writeback.c:1976 wb_writeback+0x413/0xb80 fs/fs-writeback.c:2156 wb_do_writeback fs/fs-writeback.c:2303 [inline] wb_workfn+0x410/0x1080 fs/fs-writeback.c:2343 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Commit 8b10d3653735 ("f2fs: introduce FAULT_NO_SEGMENT") allows to trigger no free segment fault in allocator, then it will update curseg->segno to NULL_SEGNO, though, CP_ERROR_FLAG has been set, f2fs_write_inode() missed to check the flag, and access invalid curseg->segno directly in below call path, then resulting in panic: - f2fs_write_inode - f2fs_is_checkpoint_ready - has_enough_free_secs - has_not_enough_free_secs - __get_secs_required - has_curseg_enough_space - get_ckpt_valid_blocks : access invalid curseg->segno To avoid this issue, let's: - check CP_ERROR_FLAG flag in prior to f2fs_is_checkpoint_ready() in f2fs_write_inode(). - in has_curseg_enough_space(), save curseg->segno into a temp variable, and verify its validation before use. Fixes: 8b10d3653735 ("f2fs: introduce FAULT_NO_SEGMENT") Reported-by: syzbot+b6b347b7a4ea1b2e29b6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67973c2b.050a0220.11b1bb.0089.GAE@google.com Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: introduce FAULT_INCONSISTENT_FOOTERChao Yu
To simulate inconsistent node footer error. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: do sanity check on xattr node footer in f2fs_get_xnode_page()Chao Yu
This patch introduces a new wrapper f2fs_get_xnode_page(), then, caller can use it to load xattr block to page cache, meanwhile it will do sanity check on xattr node footer. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-11f2fs: do sanity check on inode footer in f2fs_get_inode_page()Chao Yu
This patch introduces a new wrapper f2fs_get_inode_page(), then, caller can use it to load inode block to page cache, meanwhile it will do sanity check on inode footer. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-08f2fs: control nat_bits feature via mount optionChao Yu
Introduce a new mount option "nat_bits" to control nat_bits feature, by default nat_bits feature is disabled. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-05f2fs: set highest IO priority for checkpoint threadJaegeuk Kim
The checkpoint is the top priority thread which can stop all the filesystem operations. Let's make it RT priority. Reviewed-by: Daeho Jeong <daehojeong@google.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04mm: Remove wait_on_page_locked()Matthew Wilcox (Oracle)
This compatibility wrapper has no callers left, so remove it. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_find_data_folio()Matthew Wilcox (Oracle)
Convert f2fs_find_data_page() to f2fs_find_data_folio() and add a compatibility wrapper. Saves six hidden calls to compound_head(). This was the last caller of f2fs_get_read_data_page(), so remove the compatibility wrapper. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert gc_data_segment() to use a folioMatthew Wilcox (Oracle)
Use f2fs_get_read_data_folio() instead of f2fs_get_read_data_page(). Saves a hidden call to compound_head() in f2fs_put_page(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert truncate_partial_data_page() to use a folioMatthew Wilcox (Oracle)
Retrieve a folio from the page cache and use it throughout. Saves five hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert move_data_page() to use a folioMatthew Wilcox (Oracle)
Fetch a folio from the page cache and use it throughout, saving eight hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_get_lock_data_folio()Matthew Wilcox (Oracle)
Convert f2fs_get_lock_data_page() to f2fs_get_lock_data_folio() and add a compatibility wrapper. Removes three hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_get_read_data_folio()Matthew Wilcox (Oracle)
Convert f2fs_get_read_data_page() into f2fs_get_read_data_folio() and add a compatibility wrapper. Saves seven hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Hoist the page_folio() call to the start of f2fs_merge_page_bio()Matthew Wilcox (Oracle)
Remove one call to compound_head() and a reference to page->mapping by calling page_folio() early on. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Use a folio throughout __get_meta_page()Matthew Wilcox (Oracle)
Use f2fs_grab_cache_folio() to get a folio and use it throughout, removing seven calls to compound_head() and a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Use a folio throughout f2fs_truncate_inode_blocks()Matthew Wilcox (Oracle)
Use f2fs_get_node_folio() to get a folio and use it throughout. Remove a few calls to compound_head() and a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_get_node_folio()Matthew Wilcox (Oracle)
Change __get_node_page() to return a folio and convert back to a page in f2fs_get_node_page() and f2fs_get_node_page_ra(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert f2fs_in_warm_node_list() to take a folioMatthew Wilcox (Oracle)
All its callers now have access to a folio, so pass it in. Removes an access to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Mark some functions as taking a const page pointerMatthew Wilcox (Oracle)
The compiler can make some optimisations if we tell it that a function call doesn't change this memory. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert f2fs_write_end_io() to use a folio_iterMatthew Wilcox (Oracle)
Iterate over each folio in the bio instead of each page. Follow the pattern in ext4 for handling bounce folios. Removes a few calls to compound_head() and references to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Use a folio in do_write_page()Matthew Wilcox (Oracle)
Convert fio->page to a folio then use it where folio APIs exist. Removes a reference to page->mapping and a hidden call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Use a folio in __get_node_page()Matthew Wilcox (Oracle)
Retrieve a folio from the page cache and use it throughout. Saves six hidden calls to compound_head() and removes a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04mm: Remove grab_cache_page_write_begin()Matthew Wilcox (Oracle)
All callers have now been converted to use folios, so remove this compatibility wrapper. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_grab_cache_folio()Matthew Wilcox (Oracle)
Convert f2fs_grab_cache_page() into f2fs_grab_cache_folio() and add a wrapper. Removes several calls to deprecated functions. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Return a folio from last_fsync_dnode()Matthew Wilcox (Oracle)
Convert last_page to last_folio in f2fs_fsync_node_pages() and use folio APIs where they exist. Saves a few hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert last_fsync_dnode() to use a folioMatthew Wilcox (Oracle)
Use the folio APIs where they exist. Saves several hidden calls to compound_head(). Also removes a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert f2fs_fsync_node_pages() to use a folioMatthew Wilcox (Oracle)
Use the folio APIs where they exist. Saves several hidden calls to compound_head(). Also removes a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Pass a folio to flush_dirty_inode()Matthew Wilcox (Oracle)
Its one caller now has a folio; pass it in and do page conversions where necessary inside flush_dirty_inode(). Saves two hidden calls to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert f2fs_sync_node_pages() to use a folioMatthew Wilcox (Oracle)
Use the folio APIs where they exist. Saves several hidden calls to compound_head(). Also removes a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Convert f2fs_flush_inline_data() to use a folioMatthew Wilcox (Oracle)
Use the folio APIs where they exist. Saves several hidden calls to compound_head(). Also removes a reference to page->mapping. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_folio_put()Matthew Wilcox (Oracle)
Convert f2fs_put_page() to f2fs_folio_put() and add a wrapper. Replaces three calls to compound_head() with one. [Jaegeuk Kim: fix missing null pointer check in f2fs_put_page] Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04mm: Remove wait_for_stable_page()Matthew Wilcox (Oracle)
The last caller has been converted to call folio_wait_stable(), so we can remove this wrapper. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: Add f2fs_folio_wait_writeback()Matthew Wilcox (Oracle)
Convert f2fs_wait_on_page_writeback() to f2fs_folio_wait_writeback() and add a compatibiility wrapper. Replaces five calls to compound_head() with one. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2025-03-04f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()Chao Yu
syzbot reports an UBSAN issue as below: ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/f2fs/node.h:381:10 index 18446744073709550692 is out of range for type '__le32[5]' (aka 'unsigned int[5]') CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429 get_nid fs/f2fs/node.h:381 [inline] f2fs_truncate_inode_blocks+0xa5e/0xf60 fs/f2fs/node.c:1181 f2fs_do_truncate_blocks+0x782/0x1030 fs/f2fs/file.c:808 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:836 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:886 f2fs_file_write_iter+0x1bdb/0x2550 fs/f2fs/file.c:5093 aio_write+0x56b/0x7c0 fs/aio.c:1633 io_submit_one+0x8a7/0x18a0 fs/aio.c:2052 __do_sys_io_submit fs/aio.c:2111 [inline] __se_sys_io_submit+0x171/0x2e0 fs/aio.c:2081 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f238798cde9 index 18446744073709550692 (decimal, unsigned long long) = 0xfffffffffffffc64 (hexadecimal, unsigned long long) = -924 (decimal, long long) In f2fs_truncate_inode_blocks(), UBSAN detects that get_nid() tries to access .i_nid[-924], it means both offset[0] and level should zero. The possible case should be in f2fs_do_truncate_blocks(), we try to truncate inode size to zero, however, dn.ofs_in_node is zero and dn.node_page is not an inode page, so it fails to truncate inode page, and then pass zeroed free_from to f2fs_truncate_inode_blocks(), result in this issue. if (dn.ofs_in_node || IS_INODE(dn.node_page)) { f2fs_truncate_data_blocks_range(&dn, count); free_from += count; } I guess the reason why dn.node_page is not an inode page could be: there are multiple nat entries share the same node block address, once the node block address was reused, f2fs_get_node_page() may load a non-inode block. Let's add a sanity check for such condition to avoid out-of-bounds access issue. Reported-by: syzbot+6653f10281a1badc749e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/66fdcdf3.050a0220.40bef.0025.GAE@google.com Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>