Re: [f2fs-dev] [PATCH v3] f2fs: fix to detect corrupted meta ino

[Chao Yu]

Ping,

On 2022/9/13 15:48, Chao Yu wrote:

It is possible that ino of dirent or orphan inode is corrupted in a
fuzzed image, occasionally, if corrupted ino is equal to meta ino:
meta_ino, node_ino or compress_ino, caller of f2fs_iget() from below
call paths will get meta inode directly, it's not allowed, let's
add sanity check to detect such cases.

case #1
- recover_dentry
  - __f2fs_find_entry
  - f2fs_iget_retry

case #2
- recover_orphan_inode
  - f2fs_iget_retry

Signed-off-by: Chao Yu <c...@kernel.org>
---
v3:
- update commit title/message
- change logic inside f2fs_iget() rather than its caller
  fs/f2fs/inode.c | 25 ++++++++++++++++++-------
  1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index cde0a3dc80c3..1baac6056733 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -487,6 +487,12 @@ static int do_read_inode(struct inode *inode)
        return 0;
  }

+static bool is_meta_ino(struct f2fs_sb_info *sbi, unsigned int ino)

+{
+       return ino == F2FS_NODE_INO(sbi) || ino == F2FS_META_INO(sbi) ||
+               ino == F2FS_COMPRESS_INO(sbi);
+}
+
  struct inode *f2fs_iget(struct super_block *sb, unsigned long ino)
  {
        struct f2fs_sb_info *sbi = F2FS_SB(sb);
@@ -497,17 +503,22 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned 
long ino)
        if (!inode)
                return ERR_PTR(-ENOMEM);

+ if (is_meta_ino(sbi, ino)) {

+               if (!(inode->i_state & I_NEW)) {
+                       f2fs_err(sbi, "detect corrupted inode no:%lu, run fsck to 
repair", ino);
+                       set_sbi_flag(sbi, SBI_NEED_FSCK);
+                       ret = -EFSCORRUPTED;
+                       trace_f2fs_iget_exit(inode, ret);
+                       iput(inode);
+                       return ERR_PTR(ret);
+               }
+               goto make_now;
+       }
+
        if (!(inode->i_state & I_NEW)) {
                trace_f2fs_iget(inode);
                return inode;
        }
-       if (ino == F2FS_NODE_INO(sbi) || ino == F2FS_META_INO(sbi))
-               goto make_now;
-
-#ifdef CONFIG_F2FS_FS_COMPRESSION
-       if (ino == F2FS_COMPRESS_INO(sbi))
-               goto make_now;
-#endif

ret = do_read_inode(inode);

        if (ret)

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel