Merge tag 'f2fs-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

Pull f2fs updates from Jaegeuk Kim:
 "The changes primarily focus on filesystem error reporting, reducing
  memory footprint by reverting in-memory data structures used for
  runtime validation, honoring FDP hints, and adding trace and debug
  logs. In addition, there are critical bug fixes resolving
  out-of-bounds read vulnerabilities in inline directory and ACL
  handling, potential deadlocks in balance_fs, use-after-free issues in
  atomic writes, and false data/node type assignments in large sections.

  Enhancements:
   - Revert  in-memory sit version and block bitmaps
   - support to report fserror
   - add trace_f2fs_fault_report
   - add iostat latency tracking for direct IO
   - add logs in f2fs_disable_checkpoint()
   - honor per-I/O write streams for direct writes
   - map data writes to FDP streams
   - skip inode folio lookup for cached overwrite
   - skip direct I/O iostat context when disabled
   - revert "check in-memory block bitmap"
   - revert "check in-memory sit version bitmap"

  Fixes:
   - optimize representative type determination in GC
   - fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
   - fix potential deadlock in f2fs_balance_fs()
   - fix potential deadlock in gc_merge path of f2fs_balance_fs()
   - atomic: fix UAF issue on f2fs_inode_info.atomic_inode
   - fix missing read bio submission on large folio error
   - pass correct iostat type for single node writes
   - fix to do sanity check on f2fs_get_node_folio_ra()
   - validate orphan inode entry count
   - keep atomic write retry from zeroing original data
   - read COW data with the original inode during atomic write
   - validate inline dentry name lengths before conversion
   - validate dentry name length before lookup compares it
   - reject setattr size changes on large folio files
   - revert "remove non-uptodate folio from the page cache in move_data_block"
   - validate ACL entry sizes in f2fs_acl_from_disk()
   - bound i_inline_xattr_size for non-inline-xattr inodes
   - fix listxattr handling of corrupted xattr entries
   - fix to round down start offset of fallocate for pin file"

* tag 'f2fs-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (42 commits)
  f2fs: fix to round down start offset of fallocate for pin file
  f2fs: fix listxattr handling of corrupted xattr entries
  f2fs: skip direct I/O iostat context when disabled
  f2fs: remove unneeded f2fs_is_compressed_page()
  f2fs: avoid unnecessary fscrypt_finalize_bounce_page()
  f2fs: avoid unnecessary sanity check on ckpt_valid_blocks
  f2fs: misc cleanup in f2fs_record_stop_reason()
  f2fs: fix wrong description in printed log
  f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
  f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
  Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
  f2fs: Split f2fs_write_end_io()
  f2fs: Rename f2fs_post_read_wq into f2fs_wq
  f2fs: Prepare for supporting delayed bio completion
  f2fs: reject setattr size changes on large folio files
  f2fs: validate dentry name length before lookup compares it
  f2fs: validate inline dentry name lengths before conversion
  f2fs: read COW data with the original inode during atomic write
  f2fs: skip inode folio lookup for cached overwrite
  f2fs: keep atomic write retry from zeroing original data
  ...

Author: torvalds

Documentation/ABI/testing/sysfs-fs-f2fs

@@ -270,7 +270,8 @@ Description:	Shows all enabled kernel features.
 		inode_checksum, flexible_inline_xattr, quota_ino,
 		inode_crtime, lost_found, verity, sb_checksum,
 		casefold, readonly, compression, test_dummy_encryption_v2,
-		atomic_write, pin_file, encrypted_casefold, linear_lookup.
+		atomic_write, pin_file, encrypted_casefold, linear_lookup,
+		fserror.
 
 What:		/sys/fs/f2fs/<disk>/inject_rate
 Date:		May 2016
@@ -1000,4 +1001,4 @@ Contact:	"Chao Yu" <chao@kernel.org>
 Description:	It can be used to tune priority of f2fs critical task, e.g. f2fs_ckpt, f2fs_gc
 		threads, limitation as below:
 		- it requires user has CAP_SYS_NICE capability.
-		- the range is [100, 139], by default the value is 100.
+		- the range is [100, 139], by default the value is 120.

Documentation/filesystems/f2fs.rst

@@ -137,6 +137,15 @@ noacl			 Disable POSIX Access Control List. Note: acl is enabled
 active_logs=%u		 Support configuring the number of active logs. In the
 			 current design, f2fs supports only 2, 4, and 6 logs.
 			 Default number is 6.
+			 When the underlying block device exposes write
+			 streams, the default active_logs=6 configuration
+			 maps hot, warm, and cold DATA writes to streams 1,
+			 2, and 3, respectively. If only one or two write
+			 streams are available, f2fs falls back to mapping
+			 all DATA writes to stream 1 or mapping hot/warm
+			 to stream 1 and cold to stream 2. If no write
+			 streams are exposed, f2fs leaves the stream
+			 unset.
 disable_ext_identify	 Disable the extension list configured by mkfs, so f2fs
 			 is not aware of cold files such as media files.
 inline_xattr		 Enable the inline xattrs feature.

fs/f2fs/acl.c

@@ -47,6 +47,7 @@ static inline int f2fs_acl_count(size_t size)
 static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size)
 {
 	int i, count;
+	int err = -EINVAL;
 	struct posix_acl *acl;
 	struct f2fs_acl_header *hdr = (struct f2fs_acl_header *)value;
 	struct f2fs_acl_entry *entry = (struct f2fs_acl_entry *)(hdr + 1);
@@ -70,8 +71,11 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size)
 
 	for (i = 0; i < count; i++) {
 
-		if ((char *)entry > end)
+		if (unlikely((char *)entry +
+				sizeof(struct f2fs_acl_entry_short) > end)) {
+			err = -EFSCORRUPTED;
 			goto fail;
+		}
 
 		acl->a_entries[i].e_tag  = le16_to_cpu(entry->e_tag);
 		acl->a_entries[i].e_perm = le16_to_cpu(entry->e_perm);
@@ -86,13 +90,23 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size)
 			break;
 
 		case ACL_USER:
+			if (unlikely((char *)entry +
+					sizeof(struct f2fs_acl_entry) > end)) {
+				err = -EFSCORRUPTED;
+				goto fail;
+			}
 			acl->a_entries[i].e_uid =
 				make_kuid(&init_user_ns,
 						le32_to_cpu(entry->e_id));
 			entry = (struct f2fs_acl_entry *)((char *)entry +
 					sizeof(struct f2fs_acl_entry));
 			break;
 		case ACL_GROUP:
+			if (unlikely((char *)entry +
+					sizeof(struct f2fs_acl_entry) > end)) {
+				err = -EFSCORRUPTED;
+				goto fail;
+			}
 			acl->a_entries[i].e_gid =
 				make_kgid(&init_user_ns,
 						le32_to_cpu(entry->e_id));
@@ -108,7 +122,7 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size)
 	return acl;
 fail:
 	posix_acl_release(acl);
-	return ERR_PTR(-EINVAL);
+	return ERR_PTR(err);
 }
 
 static void *f2fs_acl_to_disk(struct f2fs_sb_info *sbi,

fs/f2fs/checkpoint.c

@@ -943,6 +943,7 @@ int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi)
 	for (i = 0; i < orphan_blocks; i++) {
 		struct folio *folio;
 		struct f2fs_orphan_block *orphan_blk;
+		unsigned int entry_count;
 
 		folio = f2fs_get_meta_folio(sbi, start_blk + i);
 		if (IS_ERR(folio)) {
@@ -951,7 +952,18 @@ int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi)
 		}
 
 		orphan_blk = folio_address(folio);
-		for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
+		entry_count = le32_to_cpu(orphan_blk->entry_count);
+		if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+			f2fs_err(sbi, "invalid orphan inode entry count %u",
+				 entry_count);
+			set_sbi_flag(sbi, SBI_NEED_FSCK);
+			f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
+			err = -EFSCORRUPTED;
+			f2fs_folio_put(folio, true);
+			goto out;
+		}
+
+		for (j = 0; j < entry_count; j++) {
 			nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
 
 			err = recover_orphan_inode(sbi, ino);

fs/f2fs/compress.c

@@ -14,6 +14,7 @@
 #include <linux/lz4.h>
 #include <linux/zstd.h>
 #include <linux/folio_batch.h>
+#include <linux/fserror.h>
 
 #include "f2fs.h"
 #include "node.h"
@@ -760,6 +761,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task)
 
 		/* Avoid f2fs_commit_super in irq context */
 		f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION);
+		fserror_report_file_metadata(dic->inode, ret, GFP_NOFS);
 		goto out_release;
 	}
 
@@ -1453,6 +1455,9 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
 out_destroy_crypt:
 	page_array_free(sbi, cic->rpages, cc->cluster_size);
 
+	if (!fio.encrypted)
+		goto out_put_cic;
+
 	for (--i; i >= 0; i--) {
 		if (!cc->cpages[i])
 			continue;
@@ -1482,8 +1487,7 @@ void f2fs_compress_write_end_io(struct bio *bio, struct folio *folio)
 	struct page *page = &folio->page;
 	struct f2fs_sb_info *sbi = bio->bi_private;
 	struct compress_io_ctx *cic = folio->private;
-	enum count_type type = WB_DATA_TYPE(folio,
-				f2fs_is_compressed_page(folio));
+	enum count_type type = WB_DATA_TYPE(folio, true);
 	int i;
 
 	if (unlikely(bio->bi_status != BLK_STS_OK))
@@ -1807,7 +1811,7 @@ static void f2fs_put_dic(struct decompress_io_ctx *dic, bool in_task)
 			f2fs_free_dic(dic, false);
 		} else {
 			INIT_WORK(&dic->free_work, f2fs_late_free_dic);
-			queue_work(dic->sbi->post_read_wq, &dic->free_work);
+			queue_work(dic->sbi->wq, &dic->free_work);
 		}
 	}
 }