f2fs: avoid BUG_ON when mouting corrupted image having garbage blocks

If the disk has some garbage blocks, F2FS is able to face with BUG_ON when
recovering direct node blocks.
This patch detects the error case and avoids that prior to reaching BUG_ON.

Alexey Khoroshilov addressed the potential security issues as follows.
"An ability to trigger a BUG_ON assert by mounting a crafted image is
usually considered as a local denial of service [1-3]. As far as I
understand, the reason is that some kernel data may become inconsistent
that can lead to further problems.

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3353
[2] http://www.openwall.com/lists/oss-security/2011/06/24/4
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2928
etc."

Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 6ebdba151f127639f6bdcb6b80764564b67e0535..64755f49d6e7acd54f6f42158065a96281d24a61 100644 (file)
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1609,6 +1609,11 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
        struct node_info old_ni, new_ni;
        struct page *ipage;
 
+       get_node_info(sbi, ino, &old_ni);
+
+       if (unlikely(old_ni.blk_addr != NULL_ADDR))
+               return -EINVAL;
+
        ipage = grab_cache_page(NODE_MAPPING(sbi), ino);
        if (!ipage)
                return -ENOMEM;
@@ -1616,7 +1621,6 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
        /* Should not use this inode  from free nid list */
        remove_free_nid(NM_I(sbi), ino);
 
-       get_node_info(sbi, ino, &old_ni);
        SetPageUptodate(ipage);
        fill_node_footer(ipage, ino, ino, 0, true);