Skip to content
  • Chao Yu's avatar
    f2fs: fix potential .flags overflow on 32bit architecture · 7653b9d8
    Chao Yu authored
    f2fs_inode_info.flags is unsigned long variable, it has 32 bits
    in 32bit architecture, since we introduced FI_MMAP_FILE flag
    when we support data compression, we may access memory cross
    the border of .flags field, corrupting .i_sem field, result in
    below deadlock.
    
    To fix this issue, let's expand .flags as an array to grab enough
    space to store new flags.
    
    Call Trace:
     __schedule+0x8d0/0x13fc
     ? mark_held_locks+0xac/0x100
     schedule+0xcc/0x260
     rwsem_down_write_slowpath+0x3ab/0x65d
     down_write+0xc7/0xe0
     f2fs_drop_nlink+0x3d/0x600 [f2fs]
     f2fs_delete_inline_entry+0x300/0x440 [f2fs]
     f2fs_delete_entry+0x3a1/0x7f0 [f2fs]
     f2fs_unlink+0x500/0x790 [f2fs]
     vfs_unlink+0x211/0x490
     do_unlinkat+0x483/0x520
     sys_unlink+0x4a/0x70
     do_fast_syscall_32+0x12b/0x683
     entry_SYSENTER_32+0xaa/0x102
    
    Fixes: 4c8ff709
    
     ("f2fs: support data compression")
    Tested-by: default avatarOndrej Jirman <megous@megous.com>
    Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    7653b9d8