* [PATCH 6.12.y v2] erofs: fix inline data read failure for ztailpacking pclusters
@ 2026-03-11 8:14 Zhiguo Niu
2026-03-11 8:19 ` Gao Xiang
2026-03-19 10:41 ` Patch "erofs: fix inline data read failure for ztailpacking pclusters" has been added to the 6.12-stable tree gregkh
0 siblings, 2 replies; 3+ messages in thread
From: Zhiguo Niu @ 2026-03-11 8:14 UTC (permalink / raw)
To: stable, gregkh
Cc: niuzhiguo84, zhiguo.niu, ke.wang, Hao_hao.Wang, hsiangkao,
linux-erofs
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit c134a40f86efb8d6b5a949ef70e06d5752209be5 ]
Compressed folios for ztailpacking pclusters must be valid before adding
these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()
may assume they are already valid and then trigger a NULL pointer
dereference.
It is somewhat hard to reproduce because the inline data is in the same
block as the tail of the compressed indexes, which are usually read just
before. However, it may still happen if a fatal signal arrives while
read_mapping_folio() is running, as shown below:
erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
...
pc : z_erofs_decompress_queue+0x4c8/0xa14
lr : z_erofs_decompress_queue+0x160/0xa14
sp : ffffffc08b3eb3a0
x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000
x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001
x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700
x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098
x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004
x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9
x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
z_erofs_decompress_queue+0x4c8/0xa14
z_erofs_runqueue+0x908/0x97c
z_erofs_read_folio+0x128/0x228
filemap_read_folio+0x68/0x128
filemap_get_pages+0x44c/0x8b4
filemap_read+0x12c/0x5b8
generic_file_read_iter+0x4c/0x15c
do_iter_readv_writev+0x188/0x1e0
vfs_iter_read+0xac/0x1a4
backing_file_read_iter+0x170/0x34c
ovl_read_iter+0xf0/0x140
vfs_read+0x28c/0x344
ksys_read+0x80/0xf0
__arm64_sys_read+0x24/0x34
invoke_syscall+0x60/0x114
el0_svc_common+0x88/0xe4
do_el0_svc+0x24/0x30
el0_svc+0x40/0xa8
el0t_64_sync_handler+0x70/0xbc
el0t_64_sync+0x1bc/0x1c0
Fix this by reading the inline data before allocating and adding
the pclusters to the I/O chains.
Fixes: cecf864d3d76 ("erofs: support inline data decompression")
Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Reviewed-and-tested-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
---
v2: align with upstream var naming,code order,error report
---
fs/erofs/zdata.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 7116f20..6e369d1 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -787,6 +787,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
struct super_block *sb = fe->inode->i_sb;
erofs_blk_t blknr = erofs_blknr(sb, map->m_pa);
struct z_erofs_pcluster *pcl = NULL;
+ void *ptr = NULL;
int ret;
DBG_BUGON(fe->pcl);
@@ -807,6 +808,14 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
} else if ((map->m_pa & ~PAGE_MASK) + map->m_plen > PAGE_SIZE) {
DBG_BUGON(1);
return -EFSCORRUPTED;
+ } else {
+ ptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
+ if (IS_ERR(ptr)) {
+ erofs_err(sb, "failed to read inline data %pe @ pa %llu of nid %llu",
+ ptr, map->m_pa, EROFS_I(fe->inode)->nid);
+ return PTR_ERR(ptr);
+ }
+ ptr = map->buf.page;
}
if (pcl) {
@@ -836,16 +845,8 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
/* bind cache first when cached decompression is preferred */
z_erofs_bind_cache(fe);
} else {
- void *mptr;
-
- mptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
- if (IS_ERR(mptr)) {
- ret = PTR_ERR(mptr);
- erofs_err(sb, "failed to get inline data %d", ret);
- return ret;
- }
- get_page(map->buf.page);
- WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, map->buf.page);
+ get_page((struct page *)ptr);
+ WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, ptr);
fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK;
fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
}
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 6.12.y v2] erofs: fix inline data read failure for ztailpacking pclusters
2026-03-11 8:14 [PATCH 6.12.y v2] erofs: fix inline data read failure for ztailpacking pclusters Zhiguo Niu
@ 2026-03-11 8:19 ` Gao Xiang
2026-03-19 10:41 ` Patch "erofs: fix inline data read failure for ztailpacking pclusters" has been added to the 6.12-stable tree gregkh
1 sibling, 0 replies; 3+ messages in thread
From: Gao Xiang @ 2026-03-11 8:19 UTC (permalink / raw)
To: Zhiguo Niu, stable, gregkh
Cc: niuzhiguo84, ke.wang, Hao_hao.Wang, linux-erofs
On 2026/3/11 16:14, Zhiguo Niu wrote:
> From: Gao Xiang <hsiangkao@linux.alibaba.com>
>
> [ Upstream commit c134a40f86efb8d6b5a949ef70e06d5752209be5 ]
>
> Compressed folios for ztailpacking pclusters must be valid before adding
> these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()
> may assume they are already valid and then trigger a NULL pointer
> dereference.
>
> It is somewhat hard to reproduce because the inline data is in the same
> block as the tail of the compressed indexes, which are usually read just
> before. However, it may still happen if a fatal signal arrives while
> read_mapping_folio() is running, as shown below:
>
> erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
>
> ...
>
> pc : z_erofs_decompress_queue+0x4c8/0xa14
> lr : z_erofs_decompress_queue+0x160/0xa14
> sp : ffffffc08b3eb3a0
> x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000
> x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001
> x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700
> x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098
> x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004
> x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9
> x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
> x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020
> x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
> Call trace:
> z_erofs_decompress_queue+0x4c8/0xa14
> z_erofs_runqueue+0x908/0x97c
> z_erofs_read_folio+0x128/0x228
> filemap_read_folio+0x68/0x128
> filemap_get_pages+0x44c/0x8b4
> filemap_read+0x12c/0x5b8
> generic_file_read_iter+0x4c/0x15c
> do_iter_readv_writev+0x188/0x1e0
> vfs_iter_read+0xac/0x1a4
> backing_file_read_iter+0x170/0x34c
> ovl_read_iter+0xf0/0x140
> vfs_read+0x28c/0x344
> ksys_read+0x80/0xf0
> __arm64_sys_read+0x24/0x34
> invoke_syscall+0x60/0x114
> el0_svc_common+0x88/0xe4
> do_el0_svc+0x24/0x30
> el0_svc+0x40/0xa8
> el0t_64_sync_handler+0x70/0xbc
> el0t_64_sync+0x1bc/0x1c0
>
> Fix this by reading the inline data before allocating and adding
> the pclusters to the I/O chains.
>
> Fixes: cecf864d3d76 ("erofs: support inline data decompression")
> Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
> Reviewed-and-tested-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
> Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Thanks,
Gao Xiang
^ permalink raw reply [flat|nested] 3+ messages in thread
* Patch "erofs: fix inline data read failure for ztailpacking pclusters" has been added to the 6.12-stable tree
2026-03-11 8:14 [PATCH 6.12.y v2] erofs: fix inline data read failure for ztailpacking pclusters Zhiguo Niu
2026-03-11 8:19 ` Gao Xiang
@ 2026-03-19 10:41 ` gregkh
1 sibling, 0 replies; 3+ messages in thread
From: gregkh @ 2026-03-19 10:41 UTC (permalink / raw)
To: Hao_hao.Wang, gregkh, hsiangkao, ke.wang, linux-erofs,
niuzhiguo84, zhiguo.niu
Cc: stable-commits
This is a note to let you know that I've just added the patch titled
erofs: fix inline data read failure for ztailpacking pclusters
to the 6.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
erofs-fix-inline-data-read-failure-for-ztailpacking-pclusters.patch
and it can be found in the queue-6.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable+bounces-224650-greg=kroah.com@vger.kernel.org Wed Mar 11 09:17:27 2026
From: Zhiguo Niu <zhiguo.niu@unisoc.com>
Date: Wed, 11 Mar 2026 16:14:29 +0800
Subject: erofs: fix inline data read failure for ztailpacking pclusters
To: <stable@vger.kernel.org>, <gregkh@linuxfoundation.org>
Cc: <niuzhiguo84@gmail.com>, <zhiguo.niu@unisoc.com>, <ke.wang@unisoc.com>, <Hao_hao.Wang@unisoc.com>, <hsiangkao@linux.alibaba.com>, <linux-erofs@lists.ozlabs.org>
Message-ID: <1773216869-2760-1-git-send-email-zhiguo.niu@unisoc.com>
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit c134a40f86efb8d6b5a949ef70e06d5752209be5 ]
Compressed folios for ztailpacking pclusters must be valid before adding
these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()
may assume they are already valid and then trigger a NULL pointer
dereference.
It is somewhat hard to reproduce because the inline data is in the same
block as the tail of the compressed indexes, which are usually read just
before. However, it may still happen if a fatal signal arrives while
read_mapping_folio() is running, as shown below:
erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
...
pc : z_erofs_decompress_queue+0x4c8/0xa14
lr : z_erofs_decompress_queue+0x160/0xa14
sp : ffffffc08b3eb3a0
x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000
x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001
x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700
x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098
x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004
x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9
x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
z_erofs_decompress_queue+0x4c8/0xa14
z_erofs_runqueue+0x908/0x97c
z_erofs_read_folio+0x128/0x228
filemap_read_folio+0x68/0x128
filemap_get_pages+0x44c/0x8b4
filemap_read+0x12c/0x5b8
generic_file_read_iter+0x4c/0x15c
do_iter_readv_writev+0x188/0x1e0
vfs_iter_read+0xac/0x1a4
backing_file_read_iter+0x170/0x34c
ovl_read_iter+0xf0/0x140
vfs_read+0x28c/0x344
ksys_read+0x80/0xf0
__arm64_sys_read+0x24/0x34
invoke_syscall+0x60/0x114
el0_svc_common+0x88/0xe4
do_el0_svc+0x24/0x30
el0_svc+0x40/0xa8
el0t_64_sync_handler+0x70/0xbc
el0t_64_sync+0x1bc/0x1c0
Fix this by reading the inline data before allocating and adding
the pclusters to the I/O chains.
Fixes: cecf864d3d76 ("erofs: support inline data decompression")
Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Reviewed-and-tested-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/zdata.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -787,6 +787,7 @@ static int z_erofs_pcluster_begin(struct
struct super_block *sb = fe->inode->i_sb;
erofs_blk_t blknr = erofs_blknr(sb, map->m_pa);
struct z_erofs_pcluster *pcl = NULL;
+ void *ptr = NULL;
int ret;
DBG_BUGON(fe->pcl);
@@ -807,6 +808,14 @@ static int z_erofs_pcluster_begin(struct
} else if ((map->m_pa & ~PAGE_MASK) + map->m_plen > PAGE_SIZE) {
DBG_BUGON(1);
return -EFSCORRUPTED;
+ } else {
+ ptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
+ if (IS_ERR(ptr)) {
+ erofs_err(sb, "failed to read inline data %pe @ pa %llu of nid %llu",
+ ptr, map->m_pa, EROFS_I(fe->inode)->nid);
+ return PTR_ERR(ptr);
+ }
+ ptr = map->buf.page;
}
if (pcl) {
@@ -836,16 +845,8 @@ static int z_erofs_pcluster_begin(struct
/* bind cache first when cached decompression is preferred */
z_erofs_bind_cache(fe);
} else {
- void *mptr;
-
- mptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
- if (IS_ERR(mptr)) {
- ret = PTR_ERR(mptr);
- erofs_err(sb, "failed to get inline data %d", ret);
- return ret;
- }
- get_page(map->buf.page);
- WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, map->buf.page);
+ get_page((struct page *)ptr);
+ WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, ptr);
fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK;
fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
}
Patches currently in stable-queue which might be from zhiguo.niu@unisoc.com are
queue-6.12/erofs-fix-inline-data-read-failure-for-ztailpacking-pclusters.patch
queue-6.12/f2fs-compress-fix-uaf-of-f2fs_inode_info-in-f2fs_free_dic.patch
queue-6.12/f2fs-compress-change-the-first-parameter-of-page_array_-alloc-free-to-sbi.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-19 10:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-11 8:14 [PATCH 6.12.y v2] erofs: fix inline data read failure for ztailpacking pclusters Zhiguo Niu
2026-03-11 8:19 ` Gao Xiang
2026-03-19 10:41 ` Patch "erofs: fix inline data read failure for ztailpacking pclusters" has been added to the 6.12-stable tree gregkh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox