[PATCH v2] jffs2: fix kernel BUG in jffs2_sum_write_sumnode on empty summary

[Shuai Liu]

From: eltavine <me at eltavine.com>

With CONFIG_JFFS2_SUMMARY enabled, jffs2_do_reserve_space() tries to
write out the current block's summary when a node and its summary
overhead do not fit. jffs2_sum_write_sumnode() assumes that at least
one summary entry has been collected and calls BUG() otherwise.

An empty summary is a valid state. For example, the syzbot reproducer
mounts an image whose selected nextblock contains only a cleanmarker
and padding, leaving 140 bytes free and no summary entries. Creating
a symlink needs 128 bytes for its inode node, but reserving another
60 bytes for the summary reaches the BUG():

  kernel BUG at fs/jffs2/summary.c:868!

Large pristine-node GC reservations and xattr updates that fail after
reserving space can also leave a newly selected block with an empty
summary and reach the same check.

Disable summary collection for the block and return through the
existing exit path. jffs2_do_reserve_space() then retries the
reservation without summary overhead, following the existing fallback
for a summary that does not fit. Use dbg_summary() for this valid
condition.

The block is scanned normally on the next mount. The on-flash format
and xattr size limits are unchanged.

Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time improvement)")
Reported-by: syzbot+0727f46a0571de01bf93 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0727f46a0571de01bf93
Reported-by: syzbot+48f2d47f83a4c223ad14 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48f2d47f83a4c223ad14
Reported-by: syzbot+e4484dcf0982d86ca2e1 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e4484dcf0982d86ca2e1
Cc: stable at vger.kernel.org
Signed-off-by: eltavine <me at eltavine.com>
Signed-off-by: Shuai Liu <847807867 at qq.com>
---

Changes in v2:
  - Credit eltavine as the code author per his request, restoring his
    original comment and debug wording, and carry his Fixes: tag, the
    additional syzbot reports and the stable Cc from his RFC. (eltavine)
  - Runtime-verified on x86_64 QEMU (block2mtd backing store, KASAN
    kernel): the syzbot C reproducer hits the BUG 2/2 runs on the
    unpatched kernel, and completes cleanly on the patched kernel.

 fs/jffs2/summary.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index 4521a7723f306..4a07b7911b210 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -864,8 +864,11 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
 		goto out;
 
 	if (!c->summary->sum_num || !c->summary->sum_list_head) {
-		JFFS2_WARNING("Empty summary info!!!\n");
-		BUG();
+		/* Nothing collected yet, e.g. freshly opened jeb */
+		dbg_summary("empty summary, disabling it for jeb at 0x%08x\n",
+			    jeb->offset);
+		jffs2_sum_disable_collecting(c->summary);
+		goto out;
 	}
 
 	datasize = c->summary->sum_size + sizeof(struct jffs2_sum_marker);
-- 
2.43.0