From nobody Sun Feb 8 01:21:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20AB9C46467 for ; Tue, 10 Jan 2023 07:49:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237300AbjAJHto (ORCPT ); Tue, 10 Jan 2023 02:49:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57714 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231349AbjAJHtm (ORCPT ); Tue, 10 Jan 2023 02:49:42 -0500 Received: from out30-44.freemail.mail.aliyun.com (out30-44.freemail.mail.aliyun.com [115.124.30.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A728178B2 for ; Mon, 9 Jan 2023 23:49:40 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R241e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018045168;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0VZIMt1I_1673336968; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VZIMt1I_1673336968) by smtp.aliyun-inc.com; Tue, 10 Jan 2023 15:49:37 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Chao Yu , Yue Hu , Jeffle Xu Cc: LKML , Gao Xiang , syzbot+c3729cda01706a04fb98@syzkaller.appspotmail.com Subject: [PATCH v2] erofs: fix kvcalloc() misuse with __GFP_NOFAIL Date: Tue, 10 Jan 2023 15:49:27 +0800 Message-Id: <20230110074927.41651-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 In-Reply-To: <20230106031937.113318-1-hsiangkao@linux.alibaba.com> References: <20230106031937.113318-1-hsiangkao@linux.alibaba.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" As reported by syzbot [1], kvcalloc() cannot work with __GFP_NOFAIL. Let's use kcalloc() instead. [1] https://lore.kernel.org/r/0000000000007796bd05f1852ec2@google.com Reported-by: syzbot+c3729cda01706a04fb98@syzkaller.appspotmail.com Fixes: fe3e5914e6dc ("erofs: try to leave (de)compressed_pages on stack if = possible") Fixes: 4f05687fd703 ("erofs: introduce struct z_erofs_decompress_backend") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang --- changes since v1: - should use kfree() instead of kvfree() as well (Chao); - add Chao's r-v-b. fs/erofs/zdata.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index ccf7c55d477f..5200bb86e264 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1032,12 +1032,12 @@ static int z_erofs_decompress_pcluster(struct z_ero= fs_decompress_backend *be, =20 if (!be->decompressed_pages) be->decompressed_pages =3D - kvcalloc(be->nr_pages, sizeof(struct page *), - GFP_KERNEL | __GFP_NOFAIL); + kcalloc(be->nr_pages, sizeof(struct page *), + GFP_KERNEL | __GFP_NOFAIL); if (!be->compressed_pages) be->compressed_pages =3D - kvcalloc(pclusterpages, sizeof(struct page *), - GFP_KERNEL | __GFP_NOFAIL); + kcalloc(pclusterpages, sizeof(struct page *), + GFP_KERNEL | __GFP_NOFAIL); =20 z_erofs_parse_out_bvecs(be); err2 =3D z_erofs_parse_in_bvecs(be, &overlapped); @@ -1085,7 +1085,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs= _decompress_backend *be, } if (be->compressed_pages < be->onstack_pages || be->compressed_pages >=3D be->onstack_pages + Z_EROFS_ONSTACK_PAGES) - kvfree(be->compressed_pages); + kfree(be->compressed_pages); z_erofs_fill_other_copies(be, err); =20 for (i =3D 0; i < be->nr_pages; ++i) { @@ -1104,7 +1104,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs= _decompress_backend *be, } =20 if (be->decompressed_pages !=3D be->onstack_pages) - kvfree(be->decompressed_pages); + kfree(be->decompressed_pages); =20 pcl->length =3D 0; pcl->partial =3D true; --=20 2.24.4