* [PATCH 5.10.y 2/2] erofs: fix unsafe pagevec reuse of hooked pclusters
2021-11-16 1:08 ` [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Gao Xiang
@ 2021-11-16 1:08 ` Gao Xiang
2021-11-19 14:34 ` Patch "erofs: fix unsafe pagevec reuse of hooked pclusters" has been added to the 5.10-stable tree gregkh
2021-11-19 14:27 ` [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
2021-11-19 14:34 ` Patch "erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()" has been added to the 5.10-stable tree gregkh
2 siblings, 1 reply; 5+ messages in thread
From: Gao Xiang @ 2021-11-16 1:08 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: Gao Xiang, linux-erofs
commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.
There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.
As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
_______________________________________________________________
| tail (partial) page | head (partial) page |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.
I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.
Call trace for reference:
z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
z_erofs_runqueue+0x5f3/0x840 [erofs]
z_erofs_readahead+0x1e8/0x320 [erofs]
read_pages+0x91/0x270
page_cache_ra_unbounded+0x18b/0x240
filemap_get_pages+0x10a/0x5f0
filemap_read+0xa9/0x330
new_sync_read+0x11b/0x1a0
vfs_read+0xf1/0x190
Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
fs/erofs/zdata.c | 13 +++++++------
fs/erofs/zpvec.h | 13 ++++++++++---
2 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index ca27d3e47857..8cb2cf612e49 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -278,8 +278,8 @@ static inline bool z_erofs_try_inplace_io(struct z_erofs_collector *clt,
/* callers must be with collection lock held */
static int z_erofs_attach_page(struct z_erofs_collector *clt,
- struct page *page,
- enum z_erofs_page_type type)
+ struct page *page, enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
int ret;
@@ -289,9 +289,9 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
z_erofs_try_inplace_io(clt, page))
return 0;
- ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
+ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type,
+ pvec_safereuse);
clt->cl->vcnt += (unsigned int)ret;
-
return ret ? 0 : -EAGAIN;
}
@@ -645,7 +645,8 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED);
retry:
- err = z_erofs_attach_page(clt, page, page_type);
+ err = z_erofs_attach_page(clt, page, page_type,
+ clt->mode >= COLLECT_PRIMARY_FOLLOWED);
/* should allocate an additional staging page for pagevec */
if (err == -EAGAIN) {
struct page *const newpage =
@@ -653,7 +654,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
newpage->mapping = Z_EROFS_MAPPING_STAGING;
err = z_erofs_attach_page(clt, newpage,
- Z_EROFS_PAGE_TYPE_EXCLUSIVE);
+ Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
if (!err)
goto retry;
}
diff --git a/fs/erofs/zpvec.h b/fs/erofs/zpvec.h
index 95a620739e6a..52898176ef31 100644
--- a/fs/erofs/zpvec.h
+++ b/fs/erofs/zpvec.h
@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor,
static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
struct page *page,
- enum z_erofs_page_type type)
+ enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
- if (!ctor->next && type)
- if (ctor->index + 1 == ctor->nr)
+ if (!ctor->next) {
+ /* some pages cannot be reused as pvec safely without I/O */
+ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
+ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
+
+ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
+ ctor->index + 1 == ctor->nr)
return false;
+ }
if (ctor->index >= ctor->nr)
z_erofs_pagevec_ctor_pagedown(ctor, false);
--
2.24.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Patch "erofs: fix unsafe pagevec reuse of hooked pclusters" has been added to the 5.10-stable tree
2021-11-16 1:08 ` [PATCH 5.10.y 2/2] erofs: fix unsafe pagevec reuse of hooked pclusters Gao Xiang
@ 2021-11-19 14:34 ` gregkh
0 siblings, 0 replies; 5+ messages in thread
From: gregkh @ 2021-11-19 14:34 UTC (permalink / raw)
To: chao, gregkh, hsiangkao, linux-erofs; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
erofs: fix unsafe pagevec reuse of hooked pclusters
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From foo@baz Fri Nov 19 03:21:54 PM CET 2021
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Tue, 16 Nov 2021 09:08:19 +0800
Subject: erofs: fix unsafe pagevec reuse of hooked pclusters
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
Cc: linux-erofs@lists.ozlabs.org, Gao Xiang <hsiangkao@linux.alibaba.com>, Chao Yu <chao@kernel.org>
Message-ID: <20211116010819.122905-2-hsiangkao@linux.alibaba.com>
From: Gao Xiang <hsiangkao@linux.alibaba.com>
commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.
There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.
As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
_______________________________________________________________
| tail (partial) page | head (partial) page |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.
I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.
Call trace for reference:
z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
z_erofs_runqueue+0x5f3/0x840 [erofs]
z_erofs_readahead+0x1e8/0x320 [erofs]
read_pages+0x91/0x270
page_cache_ra_unbounded+0x18b/0x240
filemap_get_pages+0x10a/0x5f0
filemap_read+0xa9/0x330
new_sync_read+0x11b/0x1a0
vfs_read+0xf1/0x190
Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/zdata.c | 13 +++++++------
fs/erofs/zpvec.h | 13 ++++++++++---
2 files changed, 17 insertions(+), 9 deletions(-)
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -278,8 +278,8 @@ static inline bool z_erofs_try_inplace_i
/* callers must be with collection lock held */
static int z_erofs_attach_page(struct z_erofs_collector *clt,
- struct page *page,
- enum z_erofs_page_type type)
+ struct page *page, enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
int ret;
@@ -289,9 +289,9 @@ static int z_erofs_attach_page(struct z_
z_erofs_try_inplace_io(clt, page))
return 0;
- ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
+ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type,
+ pvec_safereuse);
clt->cl->vcnt += (unsigned int)ret;
-
return ret ? 0 : -EAGAIN;
}
@@ -645,7 +645,8 @@ hitted:
tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED);
retry:
- err = z_erofs_attach_page(clt, page, page_type);
+ err = z_erofs_attach_page(clt, page, page_type,
+ clt->mode >= COLLECT_PRIMARY_FOLLOWED);
/* should allocate an additional staging page for pagevec */
if (err == -EAGAIN) {
struct page *const newpage =
@@ -653,7 +654,7 @@ retry:
newpage->mapping = Z_EROFS_MAPPING_STAGING;
err = z_erofs_attach_page(clt, newpage,
- Z_EROFS_PAGE_TYPE_EXCLUSIVE);
+ Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
if (!err)
goto retry;
}
--- a/fs/erofs/zpvec.h
+++ b/fs/erofs/zpvec.h
@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_
static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
struct page *page,
- enum z_erofs_page_type type)
+ enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
- if (!ctor->next && type)
- if (ctor->index + 1 == ctor->nr)
+ if (!ctor->next) {
+ /* some pages cannot be reused as pvec safely without I/O */
+ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
+ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
+
+ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
+ ctor->index + 1 == ctor->nr)
return false;
+ }
if (ctor->index >= ctor->nr)
z_erofs_pagevec_ctor_pagedown(ctor, false);
Patches currently in stable-queue which might be from hsiangkao@linux.alibaba.com are
queue-5.10/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
queue-5.10/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
2021-11-16 1:08 ` [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Gao Xiang
2021-11-16 1:08 ` [PATCH 5.10.y 2/2] erofs: fix unsafe pagevec reuse of hooked pclusters Gao Xiang
@ 2021-11-19 14:27 ` Greg Kroah-Hartman
2021-11-19 14:34 ` Patch "erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()" has been added to the 5.10-stable tree gregkh
2 siblings, 0 replies; 5+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-19 14:27 UTC (permalink / raw)
To: Gao Xiang; +Cc: Yue Hu, linux-erofs, stable
On Tue, Nov 16, 2021 at 09:08:18AM +0800, Gao Xiang wrote:
> From: Yue Hu <huyue2@yulong.com>
>
> commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.
>
> No any behavior to variable occupied in z_erofs_attach_page() which
> is only caller to z_erofs_pagevec_enqueue().
>
> Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
> Signed-off-by: Yue Hu <huyue2@yulong.com>
> Reviewed-by: Gao Xiang <xiang@kernel.org>
> Signed-off-by: Gao Xiang <xiang@kernel.org>
> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
> ---
> Gao Xiang: Apply this trivial cleanup (no behavior change) for easier
> backporting.
>
> fs/erofs/zdata.c | 4 +---
> fs/erofs/zpvec.h | 5 +----
> 2 files changed, 2 insertions(+), 7 deletions(-)
>
> diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
> index 86fd3bf62af6..ca27d3e47857 100644
> --- a/fs/erofs/zdata.c
> +++ b/fs/erofs/zdata.c
> @@ -282,7 +282,6 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
> enum z_erofs_page_type type)
> {
> int ret;
> - bool occupied;
>
> /* give priority for inplaceio */
> if (clt->mode >= COLLECT_PRIMARY &&
> @@ -290,8 +289,7 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
> z_erofs_try_inplace_io(clt, page))
> return 0;
>
> - ret = z_erofs_pagevec_enqueue(&clt->vector,
> - page, type, &occupied);
> + ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
> clt->cl->vcnt += (unsigned int)ret;
>
> return ret ? 0 : -EAGAIN;
> diff --git a/fs/erofs/zpvec.h b/fs/erofs/zpvec.h
> index 1d67cbd38704..95a620739e6a 100644
> --- a/fs/erofs/zpvec.h
> +++ b/fs/erofs/zpvec.h
> @@ -107,10 +107,8 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor,
>
> static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
> struct page *page,
> - enum z_erofs_page_type type,
> - bool *occupied)
> + enum z_erofs_page_type type)
> {
> - *occupied = false;
> if (!ctor->next && type)
> if (ctor->index + 1 == ctor->nr)
> return false;
> @@ -125,7 +123,6 @@ static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
> /* should remind that collector->next never equal to 1, 2 */
> if (type == (uintptr_t)ctor->next) {
> ctor->next = page;
> - *occupied = true;
> }
> ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type);
> return true;
> --
> 2.24.4
>
All now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread* Patch "erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()" has been added to the 5.10-stable tree
2021-11-16 1:08 ` [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Gao Xiang
2021-11-16 1:08 ` [PATCH 5.10.y 2/2] erofs: fix unsafe pagevec reuse of hooked pclusters Gao Xiang
2021-11-19 14:27 ` [PATCH 5.10.y 1/2] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
@ 2021-11-19 14:34 ` gregkh
2 siblings, 0 replies; 5+ messages in thread
From: gregkh @ 2021-11-19 14:34 UTC (permalink / raw)
To: gregkh, hsiangkao, huyue2, linux-erofs, xiang; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From foo@baz Fri Nov 19 03:21:54 PM CET 2021
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Tue, 16 Nov 2021 09:08:18 +0800
Subject: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
Cc: linux-erofs@lists.ozlabs.org, Yue Hu <huyue2@yulong.com>, Gao Xiang <xiang@kernel.org>, Gao Xiang <hsiangkao@linux.alibaba.com>
Message-ID: <20211116010819.122905-1-hsiangkao@linux.alibaba.com>
From: Yue Hu <huyue2@yulong.com>
commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.
No any behavior to variable occupied in z_erofs_attach_page() which
is only caller to z_erofs_pagevec_enqueue().
Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
Signed-off-by: Yue Hu <huyue2@yulong.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/zdata.c | 4 +---
fs/erofs/zpvec.h | 5 +----
2 files changed, 2 insertions(+), 7 deletions(-)
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -282,7 +282,6 @@ static int z_erofs_attach_page(struct z_
enum z_erofs_page_type type)
{
int ret;
- bool occupied;
/* give priority for inplaceio */
if (clt->mode >= COLLECT_PRIMARY &&
@@ -290,8 +289,7 @@ static int z_erofs_attach_page(struct z_
z_erofs_try_inplace_io(clt, page))
return 0;
- ret = z_erofs_pagevec_enqueue(&clt->vector,
- page, type, &occupied);
+ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
clt->cl->vcnt += (unsigned int)ret;
return ret ? 0 : -EAGAIN;
--- a/fs/erofs/zpvec.h
+++ b/fs/erofs/zpvec.h
@@ -107,10 +107,8 @@ static inline void z_erofs_pagevec_ctor_
static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
struct page *page,
- enum z_erofs_page_type type,
- bool *occupied)
+ enum z_erofs_page_type type)
{
- *occupied = false;
if (!ctor->next && type)
if (ctor->index + 1 == ctor->nr)
return false;
@@ -125,7 +123,6 @@ static inline bool z_erofs_pagevec_enque
/* should remind that collector->next never equal to 1, 2 */
if (type == (uintptr_t)ctor->next) {
ctor->next = page;
- *occupied = true;
}
ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type);
return true;
Patches currently in stable-queue which might be from hsiangkao@linux.alibaba.com are
queue-5.10/erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch
queue-5.10/erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch
^ permalink raw reply [flat|nested] 5+ messages in thread