Patch "erofs: fix erofs_insert_workgroup() lockref usage" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    erofs: fix erofs_insert_workgroup() lockref usage

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     erofs-fix-erofs_insert_workgroup-lockref-usage.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b35e70d7cd38d94c192c755754565334098d3305
Author: Gao Xiang <xiang@xxxxxxxxxx>
Date:   Tue Oct 31 14:05:24 2023 +0800

    erofs: fix erofs_insert_workgroup() lockref usage
    
    [ Upstream commit 1a0ac8bd7a4fa5b2f4ef14c3b1e9d6e5a5faae06 ]
    
    As Linus pointed out [1], lockref_put_return() is fundamentally
    designed to be something that can fail.  It behaves as a fastpath-only
    thing, and the failure case needs to be handled anyway.
    
    Actually, since the new pcluster was just allocated without being
    populated, it won't be accessed by others until it is inserted into
    XArray, so lockref helpers are actually unneeded here.
    
    Let's just set the proper reference count on initializing.
    
    [1] https://lore.kernel.org/r/CAHk-=whCga8BeQnJ3ZBh_Hfm9ctba_wpF444LpwRybVNMzO6Dw@xxxxxxxxxxxxxx
    
    Fixes: 7674a42f35ea ("erofs: use struct lockref to replace handcrafted approach")
    Reviewed-by: Chao Yu <chao@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231031060524.1103921-1-hsiangkao@xxxxxxxxxxxxxxxxx
    Signed-off-by: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/erofs/utils.c b/fs/erofs/utils.c
index cc6fb9e988991..4256a85719a1d 100644
--- a/fs/erofs/utils.c
+++ b/fs/erofs/utils.c
@@ -77,12 +77,7 @@ struct erofs_workgroup *erofs_insert_workgroup(struct super_block *sb,
 	struct erofs_sb_info *const sbi = EROFS_SB(sb);
 	struct erofs_workgroup *pre;
 
-	/*
-	 * Bump up before making this visible to others for the XArray in order
-	 * to avoid potential UAF without serialized by xa_lock.
-	 */
-	lockref_get(&grp->lockref);
-
+	DBG_BUGON(grp->lockref.count < 1);
 repeat:
 	xa_lock(&sbi->managed_pslots);
 	pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index,
@@ -96,7 +91,6 @@ struct erofs_workgroup *erofs_insert_workgroup(struct super_block *sb,
 			cond_resched();
 			goto repeat;
 		}
-		lockref_put_return(&grp->lockref);
 		grp = pre;
 	}
 	xa_unlock(&sbi->managed_pslots);
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 036f610e044b6..a7e6847f6f8f1 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -796,6 +796,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
 		return PTR_ERR(pcl);
 
 	spin_lock_init(&pcl->obj.lockref.lock);
+	pcl->obj.lockref.count = 1;	/* one ref for this request */
 	pcl->algorithmformat = map->m_algorithmformat;
 	pcl->length = 0;
 	pcl->partial = true;