Commit 10c5f102 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'erofs-for-5.18-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs 

Pull erofs fixes from Gao Xiang:
 "One patch to fix a use-after-free race related to the on-stack
  z_erofs_decompressqueue, which happens very rarely but needs to be
  fixed properly soon.

  The other patch fixes some sysfs Sphinx warnings"

* tag 'erofs-for-5.18-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  Documentation/ABI: sysfs-fs-erofs: Fix Sphinx errors
  erofs: fix use-after-free of on-stack io[]
parents 906f9040 8b1ac84d

Documentation/ABI/testing/sysfs-fs-erofs

+3 −2
Original line number Diff line number Diff line
@@ -9,8 +9,9 @@ Description: Shows all enabled kernel features. 
What:		/sys/fs/erofs/<disk>/sync_decompress

Date:		November 2021

Contact:	"Huang Jianan" <huangjianan@oppo.com>

Description:	Control strategy of sync decompression

Description:	Control strategy of sync decompression:



		- 0 (default, auto): enable for readpage, and enable for

				     readahead on atomic contexts only,

		  readahead on atomic contexts only.

		- 1 (force on): enable for readpage and readahead.

		- 2 (force off): disable for all situations.

fs/erofs/zdata.c

+4 −8
Original line number Diff line number Diff line
@@ -1066,12 +1066,9 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, 


	/* wake up the caller thread for sync decompression */

	if (sync) {

		unsigned long flags;



		spin_lock_irqsave(&io->u.wait.lock, flags);

		if (!atomic_add_return(bios, &io->pending_bios))

			wake_up_locked(&io->u.wait);

		spin_unlock_irqrestore(&io->u.wait.lock, flags);

			complete(&io->u.done);



		return;

	}
@@ -1217,7 +1214,7 @@ jobqueue_init(struct super_block *sb, 
	} else {

fg_out:

		q = fgq;

		init_waitqueue_head(&fgq->u.wait);

		init_completion(&fgq->u.done);

		atomic_set(&fgq->pending_bios, 0);

	}

	q->sb = sb;
@@ -1419,8 +1416,7 @@ static void z_erofs_runqueue(struct super_block *sb, 
		return;



	/* wait until all bios are completed */

	io_wait_event(io[JQ_SUBMIT].u.wait,

		      !atomic_read(&io[JQ_SUBMIT].pending_bios));

	wait_for_completion_io(&io[JQ_SUBMIT].u.done);



	/* handle synchronous decompress queue in the caller context */

	z_erofs_decompress_queue(&io[JQ_SUBMIT], pagepool);

fs/erofs/zdata.h

+1 −1
Original line number Diff line number Diff line
@@ -97,7 +97,7 @@ struct z_erofs_decompressqueue { 
	z_erofs_next_pcluster_t head;



	union {

		wait_queue_head_t wait;

		struct completion done;

		struct work_struct work;

	} u;

};