Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b786cb32 authored by Gao Xiang's avatar Gao Xiang Committed by Greg Kroah-Hartman
Browse files

erofs: fix unsafe pagevec reuse of hooked pclusters 

commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.

There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.

As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
 _______________________________________________________________
|  tail (partial) page |          head (partial) page           |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|

However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.

I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.

Call trace for reference:
  z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
  z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
  z_erofs_runqueue+0x5f3/0x840 [erofs]
  z_erofs_readahead+0x1e8/0x320 [erofs]
  read_pages+0x91/0x270
  page_cache_ra_unbounded+0x18b/0x240
  filemap_get_pages+0x10a/0x5f0
  filemap_read+0xa9/0x330
  new_sync_read+0x11b/0x1a0
  vfs_read+0xf1/0x190

Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org


Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: default avatarChao Yu <chao@kernel.org>
Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 83de35ae

fs/erofs/zdata.c

+7 −6
Original line number Diff line number Diff line
@@ -288,8 +288,8 @@ static inline bool z_erofs_try_inplace_io(struct z_erofs_collector *clt, 


/* callers must be with collection lock held */

static int z_erofs_attach_page(struct z_erofs_collector *clt,

			       struct page *page,

			       enum z_erofs_page_type type)

			       struct page *page, enum z_erofs_page_type type,

			       bool pvec_safereuse)

{

	int ret;
@@ -299,9 +299,9 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt, 
	    z_erofs_try_inplace_io(clt, page))

		return 0;



	ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);

	ret = z_erofs_pagevec_enqueue(&clt->vector, page, type,

				      pvec_safereuse);

	clt->cl->vcnt += (unsigned int)ret;



	return ret ? 0 : -EAGAIN;

}
@@ -652,14 +652,15 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, 
		tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED);



retry:

	err = z_erofs_attach_page(clt, page, page_type);

	err = z_erofs_attach_page(clt, page, page_type,

				  clt->mode >= COLLECT_PRIMARY_FOLLOWED);

	/* should allocate an additional staging page for pagevec */

	if (err == -EAGAIN) {

		struct page *const newpage =

			__stagingpage_alloc(pagepool, GFP_NOFS);



		err = z_erofs_attach_page(clt, newpage,

					  Z_EROFS_PAGE_TYPE_EXCLUSIVE);

					  Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);

		if (!err)

			goto retry;

	}

fs/erofs/zpvec.h

+10 −3
Original line number Diff line number Diff line
@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor, 


static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,

					   struct page *page,

					   enum z_erofs_page_type type)

					   enum z_erofs_page_type type,

					   bool pvec_safereuse)

{

	if (!ctor->next && type)

		if (ctor->index + 1 == ctor->nr)

	if (!ctor->next) {

		/* some pages cannot be reused as pvec safely without I/O */

		if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)

			type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;



		if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&

		    ctor->index + 1 == ctor->nr)

			return false;

	}



	if (ctor->index >= ctor->nr)

		z_erofs_pagevec_ctor_pagedown(ctor, false);