Messages in this thread Patch in this message |  | | From | Chen Zhongjin <> | Subject | [PATCH] erofs: Fix pcluster become inline when m_pa is zero | Date | Sat, 3 Dec 2022 17:45:27 +0800 |
| |
syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [<ffffffff821db19b>] z_erofs_do_read_page+0x99b/0x1740 [<ffffffff821dee9e>] z_erofs_readahead+0x24e/0x580 [<ffffffff814bc0d6>] read_pages+0x86/0x3d0 ...
syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index become zero although pcl is not an inline pcluster.
Then following path adds refcount for grp, but the it won't be put because pcl is inline, which makes pcl not released when shrink.
z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup_get()
To fix this, add an attribute in z_erofs_pcluster to mark the inline state which not depends on index of grp.
Fixes: cecf864d3d76 ("erofs: support inline data decompression") Reported-by: syzbot+6f8cd9a0155b366d227f@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- fs/erofs/zdata.c | 2 +- fs/erofs/zdata.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index b792d424d774..fef2624d19e3 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -517,7 +517,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) DBG_BUGON(!mutex_trylock(&pcl->lock)); if (ztailpacking) { - pcl->obj.index = 0; /* which indicates ztailpacking */ + pcl->is_inline = true; /* which indicates ztailpacking */ pcl->pageofs_in = erofs_blkoff(map->m_pa); pcl->tailpacking_size = map->m_plen; } else { diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h index d98c95212985..35051ad27521 100644 --- a/fs/erofs/zdata.h +++ b/fs/erofs/zdata.h @@ -78,6 +78,9 @@ struct z_erofs_pcluster { unsigned short tailpacking_size; }; + /* I: whether it is inline or not */ + bool is_inline; + /* I: compression algorithm format */ unsigned char algorithmformat; @@ -115,7 +118,7 @@ struct z_erofs_decompressqueue { static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) { - return !pcl->obj.index; + return pcl->is_inline; } static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) -- 2.17.1
|  |