CVE-2019-19815 (C, published 2019-12-17T07:15Z)
Description: value: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/torvalds/linux
Files changed:
fs/f2fs/data.c
fs/f2fs/f2fs.h
include/trace/events/f2fs.h
Commit message: f2fs: support swap file w/ DIO

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>


Vulnerable code:
	struct address_space *mapping = page->mapping;
	block_in_file = (sector_t)page->index;
		if (!PageUptodate(page) && !cleancache_get_page(page)) {
						  page->index,
	struct inode *inode = page->mapping->host;
		ret = f2fs_mpage_readpages(page->mapping, NULL, page, 1, false);
	struct address_space *mapping = page->mapping;
	struct inode *inode = mapping->host;
	return F2FS_M_SB(page->mapping);
	if (is_sbi_flag_set(F2FS_I_SB(inode), SBI_CP_DISABLED))
		__entry->dev		= page->mapping->host->i_sb->s_dev;
		__entry->ino		= page->mapping->host->i_ino;
		__entry->dev	= page->mapping->host->i_sb->s_dev;
		__entry->ino	= page->mapping->host->i_ino;
		__entry->dir	= S_ISDIR(page->mapping->host->i_mode);

Fixed code:
#include <linux/swap.h>
	struct address_space *mapping = page_file_mapping(page);
	block_in_file = (sector_t)page_index(page);
		if (!PageUptodate(page) && (!PageSwapCache(page) &&
					!cleancache_get_page(page))) {
						  page_index(page),
	struct inode *inode = page_file_mapping(page)->host;
		ret = f2fs_mpage_readpages(page_file_mapping(page),
						NULL, page, 1, false);
	struct inode *inode = page_file_mapping(page)->host;
	if (PageSwapCache(page))
		return __set_page_dirty_nobuffers(page);
#ifdef CONFIG_SWAP
/* Copied from generic_swapfile_activate() to check any holes */
static int check_swap_activate(struct file *swap_file, unsigned int max)
{
	struct address_space *mapping = swap_file->f_mapping;
	struct inode *inode = mapping->host;
	unsigned blocks_per_page;
	unsigned long page_no;
	unsigned blkbits;
	sector_t probe_block;
	sector_t last_block;
	sector_t lowest_block = -1;
	sector_t highest_block = 0;

	blkbits = inode->i_blkbits;
	blocks_per_page = PAGE_SIZE >> blkbits;

	/*
	 * Map all the blocks into the extent list.  This code doesn't try
	 * to be very smart.
	 */
	probe_block = 0;
	page_no = 0;
	last_block = i_size_read(inode) >> blkbits;
	while ((probe_block + blocks_per_page) <= last_block && page_no < max) {
		unsigned block_in_page;
		sector_t first_block;

		cond_resched();

		first_block = bmap(inode, probe_block);
		if (first_block == 0)
			goto bad_bmap;

		/*
		 * It must be PAGE_SIZE aligned on-disk
		 */
		if (first_block & (blocks_per_page - 1)) {
			probe_block++;
			goto reprobe;
		}

		for (block_in_page = 1; block_in_page < blocks_per_page;
					block_in_page++) {
			sector_t block;

			block = bmap(inode, probe_block + block_in_page);
			if (block == 0)
				goto bad_bmap;
			if (block != first_block + block_in_page) {
				/* Discontiguity */
				probe_block++;
				goto reprobe;
			}
		}

		first_block >>= (PAGE_SHIFT - blkbits);
		if (page_no) {	/* exclude the header page */
			if (first_block < lowest_block)
				lowest_block = first_block;
			if (first_block > highest_block)
				highest_block = first_block;
		}

		page_no++;
		probe_block += blocks_per_page;
reprobe:
		continue;
	}
	return 0;

bad_bmap:
	pr_err("swapon: swapfile has holes\n");
	return -EINVAL;
}

static int f2fs_swap_activate(struct swap_info_struct *sis, struct file *file,
				sector_t *span)
{
	struct inode *inode = file_inode(file);
	int ret;

	if (!S_ISREG(inode->i_mode))
		return -EINVAL;

	if (f2fs_readonly(F2FS_I_SB(inode)->sb))
		return -EROFS;

	ret = f2fs_convert_inline_inode(inode);
	if (ret)
		return ret;

	ret = check_swap_activate(file, sis->max);
	if (ret)
		return ret;

	set_inode_flag(inode, FI_PIN_FILE);
	f2fs_precache_extents(inode);
	f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
	return 0;
}

static void f2fs_swap_deactivate(struct file *file)
{
	struct inode *inode = file_inode(file);

	clear_inode_flag(inode, FI_PIN_FILE);
}
#else
static int f2fs_swap_activate(struct swap_info_struct *sis, struct file *file,
				sector_t *span)
{
	return -EOPNOTSUPP;
}

static void f2fs_swap_deactivate(struct file *file)
{
}
#endif

	.swap_activate  = f2fs_swap_activate,
	.swap_deactivate = f2fs_swap_deactivate,
	return F2FS_M_SB(page_file_mapping(page));
	if (is_sbi_flag_set(F2FS_I_SB(inode), SBI_CP_DISABLED) &&
					!(inode->i_flags & S_SWAPFILE))
		__entry->dev		= page_file_mapping(page)->host->i_sb->s_dev;
		__entry->ino		= page_file_mapping(page)->host->i_ino;
		__entry->dev	= page_file_mapping(page)->host->i_sb->s_dev;
		__entry->ino	= page_file_mapping(page)->host->i_ino;
		__entry->dir	=
			S_ISDIR(page_file_mapping(page)->host->i_mode);