5.4-stable patches

added patches:
	erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
	erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch

diff --git a/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch b/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
new file mode 100644 (file)
index 0000000..accc043
--- /dev/null
+++ b/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
@@ -0,0 +1,123 @@
+From foo@baz Fri Nov 19 03:25:57 PM CET 2021
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+Date: Tue, 16 Nov 2021 09:10:35 +0800
+Subject: erofs: fix unsafe pagevec reuse of hooked pclusters
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
+Cc: linux-erofs@lists.ozlabs.org, Gao Xiang <hsiangkao@linux.alibaba.com>, Chao Yu <chao@kernel.org>
+Message-ID: <20211116011035.124503-2-hsiangkao@linux.alibaba.com>
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.
+
+There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
+before actual I/O submission. Thus, the decompression chain can be
+extended if the following pcluster chain hooks such tail pcluster.
+
+As the related comment mentioned, if some page is made of a hooked
+pcluster and another followed pcluster, it can be reused for in-place
+I/O (since I/O should be submitted anyway):
+ _______________________________________________________________
+|  tail (partial) page |          head (partial) page           |
+|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
+
+However, it's by no means safe to reuse as pagevec since if such
+PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
+submission. It's somewhat hard to reproduce with LZ4 and I just found
+it (general protection fault) by ro_fsstressing a LZMA image for long
+time.
+
+I'm going to actively clean up related code together with multi-page
+folio adaption in the next few months. Let's address it directly for
+easier backporting for now.
+
+Call trace for reference:
+  z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
+  z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
+  z_erofs_runqueue+0x5f3/0x840 [erofs]
+  z_erofs_readahead+0x1e8/0x320 [erofs]
+  read_pages+0x91/0x270
+  page_cache_ra_unbounded+0x18b/0x240
+  filemap_get_pages+0x10a/0x5f0
+  filemap_read+0xa9/0x330
+  new_sync_read+0x11b/0x1a0
+  vfs_read+0xf1/0x190
+
+Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
+Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
+Cc: <stable@vger.kernel.org> # 4.19+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/erofs/zdata.c |   13 +++++++------
+ fs/erofs/zpvec.h |   13 ++++++++++---
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -288,8 +288,8 @@ static inline bool z_erofs_try_inplace_i
+ 
+ /* callers must be with collection lock held */
+ static int z_erofs_attach_page(struct z_erofs_collector *clt,
+-                             struct page *page,
+-                             enum z_erofs_page_type type)
++                             struct page *page, enum z_erofs_page_type type,
++                             bool pvec_safereuse)
+ {
+       int ret;
+ 
+@@ -299,9 +299,9 @@ static int z_erofs_attach_page(struct z_
+           z_erofs_try_inplace_io(clt, page))
+               return 0;
+ 
+-      ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
++      ret = z_erofs_pagevec_enqueue(&clt->vector, page, type,
++                                    pvec_safereuse);
+       clt->cl->vcnt += (unsigned int)ret;
+-
+       return ret ? 0 : -EAGAIN;
+ }
+ 
+@@ -652,14 +652,15 @@ hitted:
+               tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED);
+ 
+ retry:
+-      err = z_erofs_attach_page(clt, page, page_type);
++      err = z_erofs_attach_page(clt, page, page_type,
++                                clt->mode >= COLLECT_PRIMARY_FOLLOWED);
+       /* should allocate an additional staging page for pagevec */
+       if (err == -EAGAIN) {
+               struct page *const newpage =
+                       __stagingpage_alloc(pagepool, GFP_NOFS);
+ 
+               err = z_erofs_attach_page(clt, newpage,
+-                                        Z_EROFS_PAGE_TYPE_EXCLUSIVE);
++                                        Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
+               if (!err)
+                       goto retry;
+       }
+--- a/fs/erofs/zpvec.h
++++ b/fs/erofs/zpvec.h
+@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_
+ 
+ static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
+                                          struct page *page,
+-                                         enum z_erofs_page_type type)
++                                         enum z_erofs_page_type type,
++                                         bool pvec_safereuse)
+ {
+-      if (!ctor->next && type)
+-              if (ctor->index + 1 == ctor->nr)
++      if (!ctor->next) {
++              /* some pages cannot be reused as pvec safely without I/O */
++              if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
++                      type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
++
++              if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
++                  ctor->index + 1 == ctor->nr)
+                       return false;
++      }
+ 
+       if (ctor->index >= ctor->nr)
+               z_erofs_pagevec_ctor_pagedown(ctor, false);

diff --git a/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch b/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
new file mode 100644 (file)
index 0000000..86c1b39
--- /dev/null
+++ b/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
@@ -0,0 +1,68 @@
+From foo@baz Fri Nov 19 03:25:57 PM CET 2021
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+Date: Tue, 16 Nov 2021 09:10:34 +0800
+Subject: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
+Cc: linux-erofs@lists.ozlabs.org, Yue Hu <huyue2@yulong.com>, Gao Xiang <xiang@kernel.org>, Gao Xiang <hsiangkao@linux.alibaba.com>
+Message-ID: <20211116011035.124503-1-hsiangkao@linux.alibaba.com>
+
+From: Yue Hu <huyue2@yulong.com>
+
+commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.
+
+No any behavior to variable occupied in z_erofs_attach_page() which
+is only caller to z_erofs_pagevec_enqueue().
+
+Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
+Signed-off-by: Yue Hu <huyue2@yulong.com>
+Reviewed-by: Gao Xiang <xiang@kernel.org>
+Signed-off-by: Gao Xiang <xiang@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/erofs/zdata.c |    4 +---
+ fs/erofs/zpvec.h |    5 +----
+ 2 files changed, 2 insertions(+), 7 deletions(-)
+
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -292,7 +292,6 @@ static int z_erofs_attach_page(struct z_
+                              enum z_erofs_page_type type)
+ {
+       int ret;
+-      bool occupied;
+ 
+       /* give priority for inplaceio */
+       if (clt->mode >= COLLECT_PRIMARY &&
+@@ -300,8 +299,7 @@ static int z_erofs_attach_page(struct z_
+           z_erofs_try_inplace_io(clt, page))
+               return 0;
+ 
+-      ret = z_erofs_pagevec_enqueue(&clt->vector,
+-                                    page, type, &occupied);
++      ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
+       clt->cl->vcnt += (unsigned int)ret;
+ 
+       return ret ? 0 : -EAGAIN;
+--- a/fs/erofs/zpvec.h
++++ b/fs/erofs/zpvec.h
+@@ -107,10 +107,8 @@ static inline void z_erofs_pagevec_ctor_
+ 
+ static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
+                                          struct page *page,
+-                                         enum z_erofs_page_type type,
+-                                         bool *occupied)
++                                         enum z_erofs_page_type type)
+ {
+-      *occupied = false;
+       if (!ctor->next && type)
+               if (ctor->index + 1 == ctor->nr)
+                       return false;
+@@ -125,7 +123,6 @@ static inline bool z_erofs_pagevec_enque
+       /* should remind that collector->next never equal to 1, 2 */
+       if (type == (uintptr_t)ctor->next) {
+               ctor->next = page;
+-              *occupied = true;
+       }
+       ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type);
+       return true;

diff --git a/queue-5.4/series b/queue-5.4/series
index 0493f4bf376ff849097c5f7797aeb37b811b0aff..c681d40e008390df6d5362cffac9b80ad6501137 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -9,3 +9,5 @@ parisc-entry-fix-trace-test-in-syscall-exit-path.patch
 pci-msi-destroy-sysfs-before-freeing-entries.patch
 pci-msi-deal-with-devices-lying-about-their-msi-mask-capability.patch
 pci-add-msi-masking-quirk-for-nvidia-ion-ahci.patch
+erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
+erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch