Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CABymUCNq9yqhAS0zxg+-gsCjj0GgTd=wmT7TjOcRz2TTew8zDA@mail.gmail.com>
 <697a57bd-8507-1477-0176-e840b2e2f809@kernel.org>
In-Reply-To: <697a57bd-8507-1477-0176-e840b2e2f809@kernel.org>
From:   Jun Nie <jun.nie@linaro.org>
Date:   Tue, 15 Nov 2022 12:41:30 +0800
Message-ID: <CABymUCNd36Z6F3miBfSSeaXnyNT5OH_S1j6FBFM=aV_x3dfiug@mail.gmail.com>
Subject: Re: [BUG REPORT] f2fs: use-after-free during garbage collection
To:     Chao Yu <chao@kernel.org>
Cc:     jaegeuk@kernel.org, linux-f2fs-devel@lists.sourceforge.net,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Lee Jones <joneslee@google.com>, davem@davemloft.net,
        edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
        netdev@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Chao Yu <chao@kernel.org> =E4=BA=8E2022=E5=B9=B411=E6=9C=8815=E6=97=A5=E5=
=91=A8=E4=BA=8C 00:02=E5=86=99=E9=81=93=EF=BC=9A
>
> On 2022/11/14 9:47, Jun Nie wrote:
> > Hi  Chao & Jaegeuk,
> >
> > There is a KASAN report[0] that shows invalid memory
> > access(use-after-free) in f2fs garbage collection process, and this
> > issue is fixed by a recent f2fs patch set[1]. The KASAN report is cause=
d
> > by an abnormal sum->ofs_in_node value 0xc3f1 in the first check. And
> > the investigation indicates that the f2fs_summary_block address range
> > is not from f2fs_kzalloc() in build_curseg(). The memory
> > allocation/free happens in non-f2fs thread, such as network. So I
> > guess the f2fs subsystem is accessing memory that's not belong to f2fs
> > in some cases. With the below commit merged into mainline recently,
> > this  use-after-free issue disappears. But there is another thread
> > blocked issue as below. The patch c6ad7fd16657 check the valid
> > ofs_in_node and stop further gc. I am not sure whether it is expected
> > that the f2fs_summary_block address in gc thread is not from
> > allocation in build_curseg(). Because I am not familiar with f2fs.
> >
> > Could you help comment on my question and new issue? Is there any work
> > in progress to fix the new blocked issue? Thanks!
>
> Please check below patch:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=
=3Ddev-test&id=3D2272d08781a73b6d7039ed70f6d68d87ac82f256
>
Thanks for the patch! I cherry pick below 3 patches from your branch to mai=
nline
to test the bug. It is not reproduced any more.

b380cedda7c3 f2fs: fix to do sanity check on i_extra_isize in is_alive()
cdcb173c158e f2fs: Fix the race condition of resize flag between resizefs
c316fb60f5fb f2fs: should put a page when checking the summary info

BTW:  below log line is repeated endless if cdcb173c158e is missing.
[  142.766237][    T9] F2FS-fs (loop0): Inconsistent blkaddr offset:
base:9, ofs_in_node:50161, max:923, ino:8, nid:8

Regards,
Jun


> Thanks,
>
> >
> > [0] https://syzkaller.appspot.com/bug?id=3D4cbcff00422ea402c2e5be2bc041=
a8f4196d608c
> > [1] c6ad7fd16657 f2fs: fix to do sanity check on summary info
> >