• Gao Xiang's avatar
    erofs: fix unsafe pagevec reuse of hooked pclusters · 86432a6d
    Gao Xiang authored
    There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
    before actual I/O submission. Thus, the decompression chain can be
    extended if the following pcluster chain hooks such tail pcluster.
    
    As the related comment mentioned, if some page is made of a hooked
    pcluster and another followed pcluster, it can be reused for in-place
    I/O (since I/O should be submitted anyway):
     _______________________________________________________________
    |  tail (partial) page |          head (partial) page           |
    |_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
    
    However, it's by no means safe to reuse as pagevec since if such
    PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
    submission. It's somewhat hard to reproduce with LZ4 and I just found
    it (general protection fault) by ro_fsstressing a LZMA image for long
    time.
    
    I'm going to actively clean up related code together with multi-page
    folio adaption in the next few months. Let's address it directly for
    easier backporting for now.
    
    Call trace for reference:
      z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
      z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
      z_erofs_runqueue+0x5f3/0x840 [erofs]
      z_erofs_readahead+0x1e8/0x320 [erofs]
      read_pages+0x91/0x270
      page_cache_ra_unbounded+0x18b/0x240
      filemap_get_pages+0x10a/0x5f0
      filemap_read+0xa9/0x330
      new_sync_read+0x11b/0x1a0
      vfs_read+0xf1/0x190
    
    Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
    Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
    Cc: <stable@vger.kernel.org> # 4.19+
    Reviewed-by: default avatarChao Yu <chao@kernel.org>
    Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
    86432a6d
zpvec.h 3.67 KB