Messages in this thread | | | Date | Fri, 5 Nov 2021 12:28:21 +0800 | Subject | Re: [PATCH v2] erofs: fix unsafe pagevec reuse of hooked pclusters | From | Chao Yu <> |
| |
On 2021/11/4 2:20, Gao Xiang wrote: > There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL > before actual I/O submission. Thus, the decompression chain can be > extended if the following pcluster chain hooks such tail pcluster. > > As the related comment mentioned, if some page is made of a hooked > pcluster and another followed pcluster, it can be reused for in-place > I/O (since I/O should be submitted anyway): > _______________________________________________________________ > | tail (partial) page | head (partial) page | > |_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________| > > However, it's by no means safe to reuse as pagevec since if such > PRIMARY_HOOKED pclusters finally move into bypass chain without I/O > submission. It's somewhat hard to reproduce with LZ4 and I just found > it (general protection fault) by ro_fsstressing a LZMA image for long > time. > > I'm going to actively clean up related code together with multi-page > folio adaption in the next few months. Let's address it directly for > easier backporting for now. > > Call trace for reference: > z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs] > z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs] > z_erofs_runqueue+0x5f3/0x840 [erofs] > z_erofs_readahead+0x1e8/0x320 [erofs] > read_pages+0x91/0x270 > page_cache_ra_unbounded+0x18b/0x240 > filemap_get_pages+0x10a/0x5f0 > filemap_read+0xa9/0x330 > new_sync_read+0x11b/0x1a0 > vfs_read+0xf1/0x190 > > Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") > Cc: <stable@vger.kernel.org> # 4.19+ > Signed-off-by: Gao Xiang <xiang@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
| |