Bug 204193
| Summary: | BUG: KASAN: null-ptr-deref in f2fs_write_end_io+0x215/0x650 | ||
|---|---|---|---|
| Product: | File System | Reporter: | midwinter1993 |
| Component: | f2fs | Assignee: | Default virtual assignee for f2fs (filesystem_f2fs) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | CC: | chao |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 5.1.3 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
|
Description
midwinter1993
2019-07-17 02:21:09 UTC
How to reproduce this, remount to change io_bits option? (In reply to Chao Yu from comment #1) > How to reproduce this, remount to change io_bits option? It's not triggered by remount, the following script manifests it (note that this bug does not occur deterministically, you may execute it repeatedly): ``` #!/bin/bash DISK=bingo.img MOUNT_DIR=/root/mnt dd if=/dev/zero of=$DISK bs=1M count=180 mkfs.f2fs -a 1 -o 9 -t 0 -z 10 -f -q $DISK mkdir -pv $MOUNT_DIR # A little bit long options, I have not reduced it yet. mount $DISK $MOUNT_DIR -o "background_gc=on,disable_roll_forward,no_heap,nouser_xattr,active_logs=2,disable_ext_identify,inline_dentry,noinline_dentry,flush_merge,nobarrier,noextent_cache,noinline_data,checkpoint=disable,usrquota,grpquota,quota,noquota,alloc_mode=reuse,fsync_mode=posix" mkdir -pv $MOUNT_DIR/a new_dir="$MOUNT_DIR/a" for (( i = 0; i < 512; i++ )); do name=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 1` new_dir="$new_dir/$name" mkdir $new_dir done mv "$MOUNT_DIR/a" "$MOUNT_DIR/b1" mkdir -pv "$MOUNT_DIR/b1/b2/b3/b4/b5" sync for (( i = 0; i < 4096; i++ )); do name=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10` mkdir $MOUNT_DIR/b1/b2/b3/b4/b5/$name done umount $MOUNT_DIR ``` Sorry that I didn't provide the script before because it's tedious for me to reduce it. :( Thanks, I can reproduce it now. I've made a patch for this issue, could you verify it? https://lore.kernel.org/linux-f2fs-devel/20190718083959.32321-1-yuchao0@huawei.com/T/#u (In reply to Chao Yu from comment #3) > Thanks, I can reproduce it now. > > I've made a patch for this issue, could you verify it? > > https://lore.kernel.org/linux-f2fs-devel/20190718083959.32321-1- > yuchao0@huawei.com/T/#u Hi! I used the script to test the patched code several times, this bug does not manifest again. :-P Cool, I test it with your script for a long time, and it looks the bug was fixed. Anyway, thanks very much, let me close this track. :) |