Re: [PATCH v2] erofs: fix unsafe pagevec reuse of hooked pclusters

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2021/11/4 2:20, Gao Xiang wrote:
There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.

As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
  _______________________________________________________________
|  tail (partial) page |          head (partial) page           |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|

However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.

I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.

Call trace for reference:
   z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
   z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
   z_erofs_runqueue+0x5f3/0x840 [erofs]
   z_erofs_readahead+0x1e8/0x320 [erofs]
   read_pages+0x91/0x270
   page_cache_ra_unbounded+0x18b/0x240
   filemap_get_pages+0x10a/0x5f0
   filemap_read+0xa9/0x330
   new_sync_read+0x11b/0x1a0
   vfs_read+0xf1/0x190

Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable@xxxxxxxxxxxxxxx> # 4.19+
Signed-off-by: Gao Xiang <xiang@xxxxxxxxxx>

Reviewed-by: Chao Yu <chao@xxxxxxxxxx>

Thanks,



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux