Patch "erofs: Fix pcluster memleak when its block address is zero" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    erofs: Fix pcluster memleak when its block address is zero

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     erofs-fix-pcluster-memleak-when-its-block-address-is.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 35b849ec029773361ae2b0275eff9f643726cac0
Author: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
Date:   Mon Dec 5 11:49:57 2022 +0800

    erofs: Fix pcluster memleak when its block address is zero
    
    [ Upstream commit c42c0ffe81176940bd5dead474216b7198d77675 ]
    
    syzkaller reported a memleak:
    https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
    
    unreferenced object 0xffff88811009c7f8 (size 136):
      ...
      backtrace:
        [<ffffffff821db19b>] z_erofs_do_read_page+0x99b/0x1740
        [<ffffffff821dee9e>] z_erofs_readahead+0x24e/0x580
        [<ffffffff814bc0d6>] read_pages+0x86/0x3d0
        ...
    
    syzkaller constructed a case: in z_erofs_register_pcluster(),
    ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be
    zero although pcl is not a inline pcluster.
    
    Then following path adds refcount for grp, but the refcount won't be put
    because pcl is inline.
    
    z_erofs_readahead()
      z_erofs_do_read_page() # for another page
        z_erofs_collector_begin()
          erofs_find_workgroup()
            erofs_workgroup_get()
    
    Since it's illegal for the block address of a non-inlined pcluster to
    be zero, add check here to avoid registering the pcluster which would
    be leaked.
    
    Fixes: cecf864d3d76 ("erofs: support inline data decompression")
    Reported-by: syzbot+6f8cd9a0155b366d227f@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
    Reviewed-by: Yue Hu <huyue2@xxxxxxxxxxx>
    Reviewed-by: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx>
    Reviewed-by: Chao Yu <chao@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/Y42Kz6sVkf+XqJRB@debian
    Signed-off-by: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index b792d424d774..cf4871834ebb 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -488,7 +488,8 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
 	struct erofs_workgroup *grp;
 	int err;
 
-	if (!(map->m_flags & EROFS_MAP_ENCODED)) {
+	if (!(map->m_flags & EROFS_MAP_ENCODED) ||
+	    (!ztailpacking && !(map->m_pa >> PAGE_SHIFT))) {
 		DBG_BUGON(1);
 		return -EFSCORRUPTED;
 	}