Commit 5258b482 authored by Chao Yu's avatar Chao Yu Committed by Cai Xinchen
Browse files

f2fs: compress: don't allow unaligned truncation on released compress inode 

stable inclusion
from stable-v6.6.33
commit 9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ
CVE: CVE-2024-33847

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d



--------------------------------

[ Upstream commit 29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee ]

f2fs image may be corrupted after below testcase:
- mkfs.f2fs -O extra_attr,compression -f /dev/vdb
- mount /dev/vdb /mnt/f2fs
- touch /mnt/f2fs/file
- f2fs_io setflags compression /mnt/f2fs/file
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4
- f2fs_io release_cblocks /mnt/f2fs/file
- truncate -s 8192 /mnt/f2fs/file
- umount /mnt/f2fs
- fsck.f2fs /dev/vdb

[ASSERT] (fsck_chk_inode_blk:1256)  --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks
[FSCK] valid_block_count matching with CP             [Fail] [0x4, 0x5]
[FSCK] other corrupted bugs                           [Fail]

The reason is: partial truncation assume compressed inode has reserved
blocks, after partial truncation, valid block count may change w/o
.i_blocks and .total_valid_block_count update, result in corruption.

This patch only allow cluster size aligned truncation on released
compress inode for fixing.

Fixes: c6140415 ("f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit")
Signed-off-by: default avatarChao Yu <chao@kernel.org>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarCai Xinchen <caixinchen1@huawei.com>
parent 5978532a

fs/f2fs/file.c

+8 −3
Original line number Diff line number Diff line
@@ -931,9 +931,14 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 
				  ATTR_GID | ATTR_TIMES_SET))))

		return -EPERM;



	if ((attr->ia_valid & ATTR_SIZE) &&

		!f2fs_is_compress_backend_ready(inode))

	if ((attr->ia_valid & ATTR_SIZE)) {

		if (!f2fs_is_compress_backend_ready(inode))

			return -EOPNOTSUPP;

		if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED) &&

			!IS_ALIGNED(attr->ia_size,

			F2FS_BLK_TO_BYTES(F2FS_I(inode)->i_cluster_size)))

			return -EINVAL;

	}



	err = setattr_prepare(idmap, dentry, attr);

	if (err)