• Chao Yu's avatar
    f2fs: fix to initialize variable to avoid UBSAN/smatch warning · 283a29de
    Chao Yu authored
    [ Upstream commit f9aa52a8 ]
    
    As Dan Carpenter as below:
    
    The patch df634f444ee9: "f2fs: use rb_*_cached friends" from Oct 4,
    2018, leads to the following static checker warning:
    
    	fs/f2fs/extent_cache.c:606 f2fs_update_extent_tree_range()
    	error: uninitialized symbol 'leftmost'.
    
    And also Eric Biggers, and Kyungtae Kim reported, there is an UBSAN
    warning described as below:
    
    We report a bug in linux-4.20.2: "UBSAN: Undefined behaviour in
    fs/f2fs/extent_cache.c"
    
    kernel config: https://kt0755.github.io/etc/config_v4.20_stable
    repro: https://kt0755.github.io/etc/repro.4a3e7.c (f2fs is mounted on
    /mnt/f2fs/)
    
    This arose in f2fs_update_extent_tree_range (fs/f2fs/extent_cache.c:605).
    It seems that, for some reason, its last argument became "24"
    although that was supposed to be bool type.
    
    =========================================
    UBSAN: Undefined behaviour in fs/f2fs/extent_cache.c:605:4
    load of value 24 is not a valid value for type '_Bool'
    CPU: 0 PID: 6774 Comm: syz-executor5 Not tainted 4.20.2 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0xb1/0x118 lib/dump_stack.c:113
     ubsan_epilogue+0x12/0x94 lib/ubsan.c:159
     __ubsan_handle_load_invalid_value+0x17a/0x1be lib/ubsan.c:457
     f2fs_update_extent_tree_range+0x1d4a/0x1d50 fs/f2fs/extent_cache.c:605
     f2fs_update_extent_cache+0x2b6/0x350 fs/f2fs/extent_cache.c:804
     f2fs_update_data_blkaddr+0x61/0x70 fs/f2fs/data.c:656
     f2fs_outplace_write_data+0x1d6/0x4b0 fs/f2fs/segment.c:3140
     f2fs_convert_inline_page+0x86d/0x2060 fs/f2fs/inline.c:163
     f2fs_convert_inline_inode+0x6b5/0xad0 fs/f2fs/inline.c:208
     f2fs_preallocate_blocks+0x78b/0xb00 fs/f2fs/data.c:982
     f2fs_file_write_iter+0x31b/0xf40 fs/f2fs/file.c:3062
     call_write_iter include/linux/fs.h:1857 [inline]
     new_sync_write fs/read_write.c:474 [inline]
     __vfs_write+0x538/0x6e0 fs/read_write.c:487
     vfs_write+0x1b3/0x520 fs/read_write.c:549
     ksys_write+0xde/0x1c0 fs/read_write.c:598
     __do_sys_write fs/read_write.c:610 [inline]
     __se_sys_write fs/read_write.c:607 [inline]
     __x64_sys_write+0x7e/0xc0 fs/read_write.c:607
     do_syscall_64+0xbe/0x4f0 arch/x86/entry/common.c:290
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x4497b9
    Code: e8 8c 9f 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48
    89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
    01 f0 ff ff 0f 83 9b 6b fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007f1ea15edc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 00007f1ea15ee6cc RCX: 00000000004497b9
    RDX: 0000000000001000 RSI: 0000000020000140 RDI: 0000000000000013
    RBP: 000000000071bea0 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
    R13: 000000000000bb50 R14: 00000000006f4bf0 R15: 00007f1ea15ee700
    =========================================
    
    As I checked, this uninitialized variable won't cause extent cache
    corruption, but in order to avoid such kind of warning of both UBSAN
    and smatch, fix to initialize related variable.
    Reported-by: 's avatarDan Carpenter <dan.carpenter@oracle.com>
    Reported-by: 's avatarEric Biggers <ebiggers@google.com>
    Reported-by: 's avatarKyungtae Kim <kt0755@gmail.com>
    Signed-off-by: 's avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: 's avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
    283a29de
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
acl.c Loading commit data...
acl.h Loading commit data...
checkpoint.c Loading commit data...
data.c Loading commit data...
debug.c Loading commit data...
dir.c Loading commit data...
extent_cache.c Loading commit data...
f2fs.h Loading commit data...
file.c Loading commit data...
gc.c Loading commit data...
gc.h Loading commit data...
hash.c Loading commit data...
inline.c Loading commit data...
inode.c Loading commit data...
namei.c Loading commit data...
node.c Loading commit data...
node.h Loading commit data...
recovery.c Loading commit data...
segment.c Loading commit data...
segment.h Loading commit data...
shrinker.c Loading commit data...
super.c Loading commit data...
sysfs.c Loading commit data...
trace.c Loading commit data...
trace.h Loading commit data...
xattr.c Loading commit data...
xattr.h Loading commit data...