Re: [PATCH] Revert "f2fs: avoid out-of-range memory access"

[Jaegeuk Kim]

On 08/02, Chao Yu wrote:
> As Pavel Machek reported:
> 
> "We normally use -EUCLEAN to signal filesystem corruption. Plus, it is
> good idea to report it to the syslog and mark filesystem as "needing
> fsck" if filesystem can do that."
> 
> Still we need improve the original patch with:
> - use unlikely keyword
> - add message print
> - return EUCLEAN
> 
> However, after rethink this patch, I don't think we should add such
> condition check here as below reasons:
> - We have already checked the field in f2fs_sanity_check_ckpt(),
> - If there is fs corrupt or security vulnerability, there is nothing
> to guarantee the field is integrated after the check, unless we do
> the check before each of its use, however no filesystem does that.
> - We only have similar check for bitmap, which was added due to there
> is bitmap corruption happened on f2fs' runtime in product.
> - There are so many key fields in SB/CP/NAT did have such check
> after f2fs_sanity_check_{sb,cp,..}.
> 
> So I propose to revert this unneeded check.

IIRC, this came from security vulnerability report which can access
out-of-boundary memory region. Could you write another patch to address the
above issues?

> 
> This reverts commit 56f3ce675103e3fb9e631cfb4131fc768bc23e9a.
> 
> Signed-off-by: Chao Yu <yuchao0@xxxxxxxxxx>
> ---
>  fs/f2fs/segment.c | 5 -----
>  1 file changed, 5 deletions(-)
> 
> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
> index 9693fa4c8971..2eff9c008ae0 100644
> --- a/fs/f2fs/segment.c
> +++ b/fs/f2fs/segment.c
> @@ -3492,11 +3492,6 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
>  		seg_i = CURSEG_I(sbi, i);
>  		segno = le32_to_cpu(ckpt->cur_data_segno[i]);
>  		blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
> -		if (blk_off > ENTRIES_IN_SUM) {
> -			f2fs_bug_on(sbi, 1);
> -			f2fs_put_page(page, 1);
> -			return -EFAULT;
> -		}
>  		seg_i->next_segno = segno;
>  		reset_curseg(sbi, i, 0);
>  		seg_i->alloc_type = ckpt->alloc_type[i];
> -- 
> 2.18.0.rc1