From: Zhan Xusheng <zhanxusheng@xiaomi.com>

recover_orphan_inode() treats -ENOENT from f2fs_iget() as a kernel
bug, but the ino comes from the on-disk orphan block. An image whose
orphan entry names an inode without a NAT entry hits the BUG_ON at
mount with CONFIG_F2FS_CHECK_FS, or a WARN and a failed mount
without it.

To reproduce, unlink a file while it is still open, sync, crash,
then change ino[0] in the checkpoint's orphan block to an unused
nid and mount:

  kernel BUG at fs/f2fs/checkpoint.c:967!
  RIP: 0010:f2fs_recover_orphan_inodes+0x6a3/0x9a0

Treat it as corruption, the same way the entry_count check does:
fail the mount with -EFSCORRUPTED and record
ERROR_INCONSISTENT_ORPHAN for fsck.

Fixes: 8c14bfadeac2 ("f2fs: handle error of f2fs_iget correctly")
Reported-by: Guikun Yang <yangguikun19@qq.com>
Closes: https://lore.kernel.org/linux-f2fs-devel/tencent_B30A444DF94444D1A63A7D6F8E2039F1990A@qq.com/
Cc: stable@kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
Tested in QEMU on f2fs/dev with CONFIG_F2FS_CHECK_FS=y:

  orphan ino   before            after
  4 (real)     mounts            mounts
  1000         BUG at mount      -EFSCORRUPTED, s_errors bit set

 fs/f2fs/checkpoint.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 1ed38c668fc5..e57904a33ff8 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -960,12 +960,13 @@ static int recover_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino)
 
 	inode = f2fs_iget_retry(sbi->sb, ino);
 	if (IS_ERR(inode)) {
-		/*
-		 * there should be a bug that we can't find the entry
-		 * to orphan inode.
-		 */
-		f2fs_bug_on(sbi, PTR_ERR(inode) == -ENOENT);
-		return PTR_ERR(inode);
+		if (PTR_ERR(inode) != -ENOENT)
+			return PTR_ERR(inode);
+		/* The orphan area lists an inode that does not exist. */
+		f2fs_err(sbi, "orphan inode %u does not exist", ino);
+		set_sbi_flag(sbi, SBI_NEED_FSCK);
+		f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
+		return -EFSCORRUPTED;
 	}
 
 	err = f2fs_dquot_initialize(inode);

base-commit: 9b12299b437e0cc3ebf402e7b36a89cc69151238
-- 
2.43.0