From nobody Thu Sep 18 17:17:57 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03231C47088 for ; Sat, 3 Dec 2022 09:48:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229580AbiLCJsa (ORCPT ); Sat, 3 Dec 2022 04:48:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229476AbiLCJs2 (ORCPT ); Sat, 3 Dec 2022 04:48:28 -0500 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1FA842AD2 for ; Sat, 3 Dec 2022 01:48:26 -0800 (PST) Received: from dggpemm500013.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4NPQ304YqhzmVxm; Sat, 3 Dec 2022 17:47:40 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.175.36) by dggpemm500013.china.huawei.com (7.185.36.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sat, 3 Dec 2022 17:48:25 +0800 From: Chen Zhongjin To: , , CC: , , , , Subject: [PATCH] erofs: Fix pcluster become inline when m_pa is zero Date: Sat, 3 Dec 2022 17:45:27 +0800 Message-ID: <20221203094527.129869-1-chenzhongjin@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.175.36] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To dggpemm500013.china.huawei.com (7.185.36.172) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=3D62f37ff612f0021641eda5b17f056f1668aa= 9aed unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [] z_erofs_do_read_page+0x99b/0x1740 [] z_erofs_readahead+0x24e/0x580 [] read_pages+0x86/0x3d0 ... syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking =3D false and map->m_pa =3D zero. This makes pcl->obj.index become zero although pcl is not an inline pcluster. Then following path adds refcount for grp, but the it won't be put because pcl is inline, which makes pcl not released when shrink. z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup_get() To fix this, add an attribute in z_erofs_pcluster to mark the inline state which not depends on index of grp. Fixes: cecf864d3d76 ("erofs: support inline data decompression") Reported-by: syzbot+6f8cd9a0155b366d227f@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin --- fs/erofs/zdata.c | 2 +- fs/erofs/zdata.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index b792d424d774..fef2624d19e3 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -517,7 +517,7 @@ static int z_erofs_register_pcluster(struct z_erofs_dec= ompress_frontend *fe) DBG_BUGON(!mutex_trylock(&pcl->lock)); =20 if (ztailpacking) { - pcl->obj.index =3D 0; /* which indicates ztailpacking */ + pcl->is_inline =3D true; /* which indicates ztailpacking */ pcl->pageofs_in =3D erofs_blkoff(map->m_pa); pcl->tailpacking_size =3D map->m_plen; } else { diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h index d98c95212985..35051ad27521 100644 --- a/fs/erofs/zdata.h +++ b/fs/erofs/zdata.h @@ -78,6 +78,9 @@ struct z_erofs_pcluster { unsigned short tailpacking_size; }; =20 + /* I: whether it is inline or not */ + bool is_inline; + /* I: compression algorithm format */ unsigned char algorithmformat; =20 @@ -115,7 +118,7 @@ struct z_erofs_decompressqueue { =20 static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) { - return !pcl->obj.index; + return pcl->is_inline; } =20 static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *= pcl) --=20 2.17.1