• Chao Yu's avatar
    f2fs: fix to initialize variable to avoid UBSAN/smatch warning · 283a29de
    Chao Yu authored
    [ Upstream commit f9aa52a8 ]
    
    As Dan Carpenter as below:
    
    The patch df634f444ee9: "f2fs: use rb_*_cached friends" from Oct 4,
    2018, leads to the following static checker warning:
    
    	fs/f2fs/extent_cache.c:606 f2fs_update_extent_tree_range()
    	error: uninitialized symbol 'leftmost'.
    
    And also Eric Biggers, and Kyungtae Kim reported, there is an UBSAN
    warning described as below:
    
    We report a bug in linux-4.20.2: "UBSAN: Undefined behaviour in
    fs/f2fs/extent_cache.c"
    
    kernel config: https://kt0755.github.io/etc/config_v4.20_stable
    repro: https://kt0755.github.io/etc/repro.4a3e7.c (f2fs is mounted on
    /mnt/f2fs/)
    
    This arose in f2fs_update_extent_tree_range (fs/f2fs/extent_cache.c:605).
    It seems that, for some reason, its last argument became "24"
    although that was supposed to be bool type.
    
    =========================================
    UBSAN: Undefined behaviour in fs/f2fs/extent_cache.c:605:4
    load of value 24 is not a valid value for type '_Bool'
    CPU: 0 PID: 6774 Comm: syz-executor5 Not tainted 4.20.2 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0xb1/0x118 lib/dump_stack.c:113
     ubsan_epilogue+0x12/0x94 lib/ubsan.c:159
     __ubsan_handle_load_invalid_value+0x17a/0x1be lib/ubsan.c:457
     f2fs_update_extent_tree_range+0x1d4a/0x1d50 fs/f2fs/extent_cache.c:605
     f2fs_update_extent_cache+0x2b6/0x350 fs/f2fs/extent_cache.c:804
     f2fs_update_data_blkaddr+0x61/0x70 fs/f2fs/data.c:656
     f2fs_outplace_write_data+0x1d6/0x4b0 fs/f2fs/segment.c:3140
     f2fs_convert_inline_page+0x86d/0x2060 fs/f2fs/inline.c:163
     f2fs_convert_inline_inode+0x6b5/0xad0 fs/f2fs/inline.c:208
     f2fs_preallocate_blocks+0x78b/0xb00 fs/f2fs/data.c:982
     f2fs_file_write_iter+0x31b/0xf40 fs/f2fs/file.c:3062
     call_write_iter include/linux/fs.h:1857 [inline]
     new_sync_write fs/read_write.c:474 [inline]
     __vfs_write+0x538/0x6e0 fs/read_write.c:487
     vfs_write+0x1b3/0x520 fs/read_write.c:549
     ksys_write+0xde/0x1c0 fs/read_write.c:598
     __do_sys_write fs/read_write.c:610 [inline]
     __se_sys_write fs/read_write.c:607 [inline]
     __x64_sys_write+0x7e/0xc0 fs/read_write.c:607
     do_syscall_64+0xbe/0x4f0 arch/x86/entry/common.c:290
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x4497b9
    Code: e8 8c 9f 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48
    89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
    01 f0 ff ff 0f 83 9b 6b fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007f1ea15edc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 00007f1ea15ee6cc RCX: 00000000004497b9
    RDX: 0000000000001000 RSI: 0000000020000140 RDI: 0000000000000013
    RBP: 000000000071bea0 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
    R13: 000000000000bb50 R14: 00000000006f4bf0 R15: 00007f1ea15ee700
    =========================================
    
    As I checked, this uninitialized variable won't cause extent cache
    corruption, but in order to avoid such kind of warning of both UBSAN
    and smatch, fix to initialize related variable.
    Reported-by: 's avatarDan Carpenter <dan.carpenter@oracle.com>
    Reported-by: 's avatarEric Biggers <ebiggers@google.com>
    Reported-by: 's avatarKyungtae Kim <kt0755@gmail.com>
    Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
    283a29de
Name
Last commit
Last update
..
9p Loading commit data...
adfs Loading commit data...
affs Loading commit data...
afs Loading commit data...
autofs Loading commit data...
befs Loading commit data...
bfs Loading commit data...
btrfs Loading commit data...
cachefiles Loading commit data...
ceph Loading commit data...
cifs Loading commit data...
coda Loading commit data...
configfs Loading commit data...
cramfs Loading commit data...
crypto Loading commit data...
debugfs Loading commit data...
devpts Loading commit data...
dlm Loading commit data...
ecryptfs Loading commit data...
efivarfs Loading commit data...
efs Loading commit data...
exofs Loading commit data...
exportfs Loading commit data...
ext2 Loading commit data...
ext4 Loading commit data...
f2fs Loading commit data...
fat Loading commit data...
freevxfs Loading commit data...
fscache Loading commit data...
fuse Loading commit data...
gfs2 Loading commit data...
hfs Loading commit data...
hfsplus Loading commit data...
hostfs Loading commit data...
hpfs Loading commit data...
hugetlbfs Loading commit data...
isofs Loading commit data...
jbd2 Loading commit data...
jffs2 Loading commit data...
jfs Loading commit data...
kernfs Loading commit data...
lockd Loading commit data...
minix Loading commit data...
nfs Loading commit data...
nfs_common Loading commit data...
nfsd Loading commit data...
nilfs2 Loading commit data...
nls Loading commit data...
notify Loading commit data...
ntfs Loading commit data...
ocfs2 Loading commit data...
omfs Loading commit data...
openpromfs Loading commit data...
orangefs Loading commit data...
overlayfs Loading commit data...
proc Loading commit data...
pstore Loading commit data...
qnx4 Loading commit data...
qnx6 Loading commit data...
quota Loading commit data...
ramfs Loading commit data...
reiserfs Loading commit data...
romfs Loading commit data...
squashfs Loading commit data...
sysfs Loading commit data...
sysv Loading commit data...
tracefs Loading commit data...
ubifs Loading commit data...
udf Loading commit data...
ufs Loading commit data...
xfs Loading commit data...
Kconfig Loading commit data...
Kconfig.binfmt Loading commit data...
Makefile Loading commit data...
aio.c Loading commit data...
anon_inodes.c Loading commit data...
attr.c Loading commit data...
bad_inode.c Loading commit data...
binfmt_aout.c Loading commit data...
binfmt_elf.c Loading commit data...
binfmt_elf_fdpic.c Loading commit data...
binfmt_em86.c Loading commit data...
binfmt_flat.c Loading commit data...
binfmt_misc.c Loading commit data...
binfmt_script.c Loading commit data...
block_dev.c Loading commit data...
buffer.c Loading commit data...
char_dev.c Loading commit data...
compat.c Loading commit data...
compat_binfmt_elf.c Loading commit data...
compat_ioctl.c Loading commit data...
coredump.c Loading commit data...
d_path.c Loading commit data...
dax.c Loading commit data...
dcache.c Loading commit data...
dcookies.c Loading commit data...
direct-io.c Loading commit data...
drop_caches.c Loading commit data...
eventfd.c Loading commit data...
eventpoll.c Loading commit data...
exec.c Loading commit data...
fcntl.c Loading commit data...
fhandle.c Loading commit data...
file.c Loading commit data...
file_table.c Loading commit data...
filesystems.c Loading commit data...
fs-writeback.c Loading commit data...
fs_pin.c Loading commit data...
fs_struct.c Loading commit data...
inode.c Loading commit data...
internal.h Loading commit data...
ioctl.c Loading commit data...
iomap.c Loading commit data...
libfs.c Loading commit data...
locks.c Loading commit data...
mbcache.c Loading commit data...
mount.h Loading commit data...
mpage.c Loading commit data...
namei.c Loading commit data...
namespace.c Loading commit data...
no-block.c Loading commit data...
nsfs.c Loading commit data...
open.c Loading commit data...
pipe.c Loading commit data...
pnode.c Loading commit data...
pnode.h Loading commit data...
posix_acl.c Loading commit data...
proc_namespace.c Loading commit data...
read_write.c Loading commit data...
readdir.c Loading commit data...
select.c Loading commit data...
seq_file.c Loading commit data...
signalfd.c Loading commit data...
splice.c Loading commit data...
stack.c Loading commit data...
stat.c Loading commit data...
statfs.c Loading commit data...
super.c Loading commit data...
sync.c Loading commit data...
timerfd.c Loading commit data...
userfaultfd.c Loading commit data...
utimes.c Loading commit data...
xattr.c Loading commit data...