From: Greg Kroah-Hartman Date: Fri, 19 Nov 2021 14:34:39 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v5.4.161~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=573bb15b3dc18222b9ffbc91d4c8856c954d97c1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch --- diff --git a/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch b/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch new file mode 100644 index 00000000000..accc043400e --- /dev/null +++ b/queue-5.4/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch @@ -0,0 +1,123 @@ +From foo@baz Fri Nov 19 03:25:57 PM CET 2021 +From: Gao Xiang +Date: Tue, 16 Nov 2021 09:10:35 +0800 +Subject: erofs: fix unsafe pagevec reuse of hooked pclusters +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: linux-erofs@lists.ozlabs.org, Gao Xiang , Chao Yu +Message-ID: <20211116011035.124503-2-hsiangkao@linux.alibaba.com> + +From: Gao Xiang + +commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream. + +There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL +before actual I/O submission. Thus, the decompression chain can be +extended if the following pcluster chain hooks such tail pcluster. + +As the related comment mentioned, if some page is made of a hooked +pcluster and another followed pcluster, it can be reused for in-place +I/O (since I/O should be submitted anyway): + _______________________________________________________________ +| tail (partial) page | head (partial) page | +|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________| + +However, it's by no means safe to reuse as pagevec since if such +PRIMARY_HOOKED pclusters finally move into bypass chain without I/O +submission. It's somewhat hard to reproduce with LZ4 and I just found +it (general protection fault) by ro_fsstressing a LZMA image for long +time. + +I'm going to actively clean up related code together with multi-page +folio adaption in the next few months. Let's address it directly for +easier backporting for now. + +Call trace for reference: + z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs] + z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs] + z_erofs_runqueue+0x5f3/0x840 [erofs] + z_erofs_readahead+0x1e8/0x320 [erofs] + read_pages+0x91/0x270 + page_cache_ra_unbounded+0x18b/0x240 + filemap_get_pages+0x10a/0x5f0 + filemap_read+0xa9/0x330 + new_sync_read+0x11b/0x1a0 + vfs_read+0xf1/0x190 + +Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org +Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") +Cc: # 4.19+ +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman +--- + fs/erofs/zdata.c | 13 +++++++------ + fs/erofs/zpvec.h | 13 ++++++++++--- + 2 files changed, 17 insertions(+), 9 deletions(-) + +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -288,8 +288,8 @@ static inline bool z_erofs_try_inplace_i + + /* callers must be with collection lock held */ + static int z_erofs_attach_page(struct z_erofs_collector *clt, +- struct page *page, +- enum z_erofs_page_type type) ++ struct page *page, enum z_erofs_page_type type, ++ bool pvec_safereuse) + { + int ret; + +@@ -299,9 +299,9 @@ static int z_erofs_attach_page(struct z_ + z_erofs_try_inplace_io(clt, page)) + return 0; + +- ret = z_erofs_pagevec_enqueue(&clt->vector, page, type); ++ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type, ++ pvec_safereuse); + clt->cl->vcnt += (unsigned int)ret; +- + return ret ? 0 : -EAGAIN; + } + +@@ -652,14 +652,15 @@ hitted: + tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED); + + retry: +- err = z_erofs_attach_page(clt, page, page_type); ++ err = z_erofs_attach_page(clt, page, page_type, ++ clt->mode >= COLLECT_PRIMARY_FOLLOWED); + /* should allocate an additional staging page for pagevec */ + if (err == -EAGAIN) { + struct page *const newpage = + __stagingpage_alloc(pagepool, GFP_NOFS); + + err = z_erofs_attach_page(clt, newpage, +- Z_EROFS_PAGE_TYPE_EXCLUSIVE); ++ Z_EROFS_PAGE_TYPE_EXCLUSIVE, true); + if (!err) + goto retry; + } +--- a/fs/erofs/zpvec.h ++++ b/fs/erofs/zpvec.h +@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_ + + static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor, + struct page *page, +- enum z_erofs_page_type type) ++ enum z_erofs_page_type type, ++ bool pvec_safereuse) + { +- if (!ctor->next && type) +- if (ctor->index + 1 == ctor->nr) ++ if (!ctor->next) { ++ /* some pages cannot be reused as pvec safely without I/O */ ++ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse) ++ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED; ++ ++ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE && ++ ctor->index + 1 == ctor->nr) + return false; ++ } + + if (ctor->index >= ctor->nr) + z_erofs_pagevec_ctor_pagedown(ctor, false); diff --git a/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch b/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch new file mode 100644 index 00000000000..86c1b395126 --- /dev/null +++ b/queue-5.4/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch @@ -0,0 +1,68 @@ +From foo@baz Fri Nov 19 03:25:57 PM CET 2021 +From: Gao Xiang +Date: Tue, 16 Nov 2021 09:10:34 +0800 +Subject: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: linux-erofs@lists.ozlabs.org, Yue Hu , Gao Xiang , Gao Xiang +Message-ID: <20211116011035.124503-1-hsiangkao@linux.alibaba.com> + +From: Yue Hu + +commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream. + +No any behavior to variable occupied in z_erofs_attach_page() which +is only caller to z_erofs_pagevec_enqueue(). + +Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com +Signed-off-by: Yue Hu +Reviewed-by: Gao Xiang +Signed-off-by: Gao Xiang +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman +--- + fs/erofs/zdata.c | 4 +--- + fs/erofs/zpvec.h | 5 +---- + 2 files changed, 2 insertions(+), 7 deletions(-) + +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -292,7 +292,6 @@ static int z_erofs_attach_page(struct z_ + enum z_erofs_page_type type) + { + int ret; +- bool occupied; + + /* give priority for inplaceio */ + if (clt->mode >= COLLECT_PRIMARY && +@@ -300,8 +299,7 @@ static int z_erofs_attach_page(struct z_ + z_erofs_try_inplace_io(clt, page)) + return 0; + +- ret = z_erofs_pagevec_enqueue(&clt->vector, +- page, type, &occupied); ++ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type); + clt->cl->vcnt += (unsigned int)ret; + + return ret ? 0 : -EAGAIN; +--- a/fs/erofs/zpvec.h ++++ b/fs/erofs/zpvec.h +@@ -107,10 +107,8 @@ static inline void z_erofs_pagevec_ctor_ + + static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor, + struct page *page, +- enum z_erofs_page_type type, +- bool *occupied) ++ enum z_erofs_page_type type) + { +- *occupied = false; + if (!ctor->next && type) + if (ctor->index + 1 == ctor->nr) + return false; +@@ -125,7 +123,6 @@ static inline bool z_erofs_pagevec_enque + /* should remind that collector->next never equal to 1, 2 */ + if (type == (uintptr_t)ctor->next) { + ctor->next = page; +- *occupied = true; + } + ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type); + return true; diff --git a/queue-5.4/series b/queue-5.4/series index 0493f4bf376..c681d40e008 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -9,3 +9,5 @@ parisc-entry-fix-trace-test-in-syscall-exit-path.patch pci-msi-destroy-sysfs-before-freeing-entries.patch pci-msi-deal-with-devices-lying-about-their-msi-mask-capability.patch pci-add-msi-masking-quirk-for-nvidia-ion-ahci.patch +erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch +erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch