Re: [BUG] Kernel BUG when mounting and then unmounting a fuzzed F2FS image

[Chao Yu]

Hi Anatoly,

Could you please try pending v5.00rc1 or v4.20rc1, since in this round we
have fixed this issue with below commit:

edc55aaf0d17 ("f2fs: avoid f2fs_bug_on if f2fs_get_meta_page_nofail got EIO")

Thanks,

On 2018/10/28 19:50, Anatoly Trosinenko wrote:
> Hello,
> 
> When mounting and then unmounting a fuzzed F2FS image, a BUG is
> triggered at fs/f2fs/checkpoint.c:127.
> 
> How to reproduce with kvm-xfstests:
> 1) Checkout v4.19, copy x86_64-config-4.14 to .config, perform `make
> olddefconfig`, then compile
> 2) Place the attached image (128M unpacked) to /tmp/kvm-xfstests-$USER
> 3) Inside the `kvm-xfstests shell` execute:
> 
> root@kvm-xfstests:~# mount /vtmp
> root@kvm-xfstests:~# mount /vtmp/f2fs.img /mnt
> [   11.456857] F2FS-fs (loop0): Found nat_bits in checkpoint
> [   11.460360] F2FS-fs (loop0): Mounted with checkpoint version = 1c8a6001
> root@kvm-xfstests:~# umount /mnt
> [   14.592761] ------------[ cut here ]------------
> [   14.593218] kernel BUG at fs/f2fs/checkpoint.c:127!
> [   14.593739] invalid opcode: 0000 [#1] SMP PTI
> [   14.594129] CPU: 0 PID: 368 Comm: umount Not tainted 4.19.0-xfstests #1
> [   14.594710] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.11.1-1ubuntu1 04/01/2014
> [   14.595497] RIP: 0010:f2fs_get_meta_page_nofail+0x41/0x50
> [   14.596030] Code: 00 00 4c 89 e6 48 89 ef e8 1c f3 ff ff 48 3d 00
> f0 ff ff 76 17 48 83 f8 fb 75 05 83 eb 01 75 dd 31 f6 48 89 ef e8 bf
> fe ff ff <0f> 0b 5b 5d 41 5c c3 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00
> 31 d2
> [   14.597784] RSP: 0018:ffffb95ec095fad8 EFLAGS: 00010296
> [   14.598257] RAX: ffff9982b9d2d280 RBX: 0000000000000009 RCX: 0000000000000000
> [   14.598935] RDX: ffffffff00000001 RSI: 0000000000000007 RDI: 0000000000000246
> [   14.599608] RBP: ffff9982babe0000 R08: 00000004d0a24803 R09: 0000000000000001
> [   14.600286] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000001201aef
> [   14.600953] R13: ffff9982b9d14c00 R14: 00000000009008ef R15: 0000000000000001
> [   14.601625] FS:  0000000000000000(0000) GS:ffff9982bda00000(0063)
> knlGS:00000000f7bdab00
> [   14.602384] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
> [   14.602899] CR2: 0000000056c95460 CR3: 00000000785ea006 CR4: 0000000000360ef0
> [   14.603550] Call Trace:
> [   14.603779]  __flush_nat_entry_set+0x118/0x620
> [   14.604182]  f2fs_flush_nat_entries+0x239/0x290
> [   14.604585]  ? __submit_merged_write_cond+0xa7/0x200
> [   14.605026]  ? up_write+0x1c/0x80
> [   14.605324]  ? __submit_merged_write_cond+0xa7/0x200
> [   14.605764]  f2fs_write_checkpoint+0x45c/0x720
> [   14.606161]  f2fs_sync_fs+0xb9/0x1a0
> [   14.606482]  sync_filesystem+0x71/0x90
> [   14.606818]  generic_shutdown_super+0x22/0x100
> [   14.607214]  kill_block_super+0x21/0x50
> [   14.607558]  kill_f2fs_super+0x67/0xc0
> [   14.607893]  deactivate_locked_super+0x2f/0x70
> [   14.608292]  cleanup_mnt+0x3b/0x70
> [   14.608598]  task_work_run+0x9e/0xd0
> [   14.608919]  exit_to_usermode_loop+0xb7/0xc0
> [   14.609299]  do_fast_syscall_32+0x267/0x2f0
> [   14.609672]  entry_SYSENTER_compat+0x84/0x96
> [   14.610082] ---[ end trace d15a41554e67c0ec ]---
> [   14.610500] RIP: 0010:f2fs_get_meta_page_nofail+0x41/0x50
> [   14.610979] Code: 00 00 4c 89 e6 48 89 ef e8 1c f3 ff ff 48 3d 00
> f0 ff ff 76 17 48 83 f8 fb 75 05 83 eb 01 75 dd 31 f6 48 89 ef e8 bf
> fe ff ff <0f> 0b 5b 5d 41 5c c3 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00
> 31 d2
> [   14.612632] RSP: 0018:ffffb95ec095fad8 EFLAGS: 00010296
> [   14.613096] RAX: ffff9982b9d2d280 RBX: 0000000000000009 RCX: 0000000000000000
> [   14.613720] RDX: ffffffff00000001 RSI: 0000000000000007 RDI: 0000000000000246
> [   14.614347] RBP: ffff9982babe0000 R08: 00000004d0a24803 R09: 0000000000000001
> [   14.614974] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000001201aef
> [   14.615610] R13: ffff9982b9d14c00 R14: 00000000009008ef R15: 0000000000000001
> [   14.616240] FS:  0000000000000000(0000) GS:ffff9982bda00000(0063)
> knlGS:00000000f7bdab00
> [   14.616949] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
> [   14.617457] CR2: 0000000056c95460 CR3: 00000000785ea006 CR4: 0000000000360ef0
> Segmentation fault
> root@kvm-xfstests:~#
> 
> Best regards
> Anatoly
>