From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1175BC43381 for ; Wed, 27 Feb 2019 14:43:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D7C2C217F9 for ; Wed, 27 Feb 2019 14:43:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1551278606; bh=K0m1JLHGnuAdzsriVE8WR5T5Tnan6ReMWh1ujtMP64s=; h=Subject:To:From:Date:List-ID:From; b=cdLSpUlAwAUn/Z9SN1ILftm9QpkWaKH96xw88+j0wFF/8vedQwUZ1tdbLRLN+CHy/ +iE2bbtPmdL7WSSdeMC6zS0YdDzM16RnPy3xVJmSDi1BjU/SW8kOgpSGDHrZkkMu0o dV+RY5A95Hq6qmkuZ5hIWlpm+ePcY0UAhgzeVwis= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730522AbfB0On0 (ORCPT ); Wed, 27 Feb 2019 09:43:26 -0500 Received: from mail.kernel.org ([198.145.29.99]:52244 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730514AbfB0On0 (ORCPT ); Wed, 27 Feb 2019 09:43:26 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0D747217F5; Wed, 27 Feb 2019 14:43:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1551278604; bh=K0m1JLHGnuAdzsriVE8WR5T5Tnan6ReMWh1ujtMP64s=; h=Subject:To:From:Date:From; b=amNF4oN5fcAksZLs6UWQzFC6t+ZPKkSSu5RC6Cj3WtjWQ4CYHhvzXpVQGCHvFernc NtN05691jG9x8PfjlAdHqQdPSMxYDnCZcZY1Aok01ozLdjEmxbUZalVfTj/9RluGg+ qjWMEtY9ZJQNIj5oxm1I8N2PFl4rCau3qr3bSKog= Subject: patch "staging: erofs: fix illegal address access under memory pressure" added to staging-testing To: gaoxiang25@huawei.com, gregkh@linuxfoundation.org, stable@vger.kernel.org, yuchao0@huawei.com From: Date: Wed, 27 Feb 2019 15:43:18 +0100 Message-ID: <155127859851193@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled staging: erofs: fix illegal address access under memory pressure to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 1e5ceeab6929585512c63d05911d6657064abf7b Mon Sep 17 00:00:00 2001 From: Gao Xiang Date: Wed, 27 Feb 2019 13:33:31 +0800 Subject: staging: erofs: fix illegal address access under memory pressure Considering a read request with two decompressed file pages, If a decompression work cannot be started on the previous page due to memory pressure but in-memory LTP map lookup is done, builder->work should be still NULL. Moreover, if the current page also belongs to the same map, it won't try to start the decompression work again and then run into trouble. This patch aims to solve the above issue only with little changes as much as possible in order to make the fix backport easier. kernel message is: <4>[1051408.015930s]SLUB: Unable to allocate memory on node -1, gfp=0x2408040(GFP_NOFS|__GFP_ZERO) <4>[1051408.015930s] cache: erofs_compress, object size: 144, buffer size: 144, default order: 0, min order: 0 <4>[1051408.015930s] node 0: slabs: 98, objs: 2744, free: 0 * Cannot allocate the decompression work <3>[1051408.015960s]erofs: z_erofs_vle_normalaccess_readpages, readahead error at page 1008 of nid 5391488 * Note that the previous page was failed to read <0>[1051408.015960s]Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP ... <4>[1051408.015991s]Hardware name: kirin710 (DT) ... <4>[1051408.016021s]PC is at z_erofs_vle_work_add_page+0xa0/0x17c <4>[1051408.016021s]LR is at z_erofs_do_read_page+0x12c/0xcf0 ... <4>[1051408.018096s][] z_erofs_vle_work_add_page+0xa0/0x17c <4>[1051408.018096s][] z_erofs_vle_normalaccess_readpages+0x1a0/0x37c <4>[1051408.018096s][] read_pages+0x70/0x190 <4>[1051408.018127s][] __do_page_cache_readahead+0x194/0x1a8 <4>[1051408.018127s][] filemap_fault+0x398/0x684 <4>[1051408.018127s][] __do_fault+0x8c/0x138 <4>[1051408.018127s][] handle_pte_fault+0x730/0xb7c <4>[1051408.018127s][] __handle_mm_fault+0xac/0xf4 <4>[1051408.018157s][] handle_mm_fault+0x7c/0x118 <4>[1051408.018157s][] do_page_fault+0x354/0x474 <4>[1051408.018157s][] do_translation_fault+0x40/0x48 <4>[1051408.018157s][] do_mem_abort+0x80/0x100 <4>[1051408.018310s]---[ end trace 9f4009a3283bd78b ]--- Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Cc: # 4.19+ Signed-off-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Greg Kroah-Hartman --- drivers/staging/erofs/unzip_vle.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c index 416dde4e8ea1..74c13b0a3d33 100644 --- a/drivers/staging/erofs/unzip_vle.c +++ b/drivers/staging/erofs/unzip_vle.c @@ -698,8 +698,12 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe, /* lucky, within the range of the current map_blocks */ if (offset + cur >= map->m_la && - offset + cur < map->m_la + map->m_llen) + offset + cur < map->m_la + map->m_llen) { + /* didn't get a valid unzip work previously (very rare) */ + if (!builder->work) + goto restart_now; goto hitted; + } /* go ahead the next map_blocks */ debugln("%s: [out-of-range] pos %llu", __func__, offset + cur); @@ -713,6 +717,7 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe, if (unlikely(err)) goto err_out; +restart_now: if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED))) goto hitted; -- 2.21.0