Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Huang Jianan <huangjianan@oppo.com>
To:     linux-unionfs@vger.kernel.org, miklos@szeredi.hu,
        linux-erofs@lists.ozlabs.org, xiang@kernel.org, chao@kernel.org
Cc:     huangjianan@oppo.com, guoweichao@oppo.com, yh@oppo.com,
        zhangshiming@oppo.com, guanyuwei@oppo.com, jnhuang95@gmail.com,
        linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: [PATCH v3] ovl: fix null pointer when filesystem doesn't support direct IO
Date:   Wed, 22 Sep 2021 15:23:26 +0800
Message-Id: <20210922072326.3538-1-huangjianan@oppo.com>
In-Reply-To: <9ef909de-1854-b4be-d272-2b4cda52329f@oppo.com>
References: <9ef909de-1854-b4be-d272-2b4cda52329f@oppo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from PC80253450.adc.com (58.252.5.73) by HK2PR02CA0146.apcprd02.prod.outlook.com (2603:1096:202:16::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.13 via Frontend Transport; Wed, 22 Sep 2021 07:23:35 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d439daf3-7223-4f2c-a145-08d97d99e4a3
X-MS-TrafficTypeDiagnostic: SG2PR02MB2557:
X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <SG2PR02MB2557170B3FDC677A042A90E9C3A29@SG2PR02MB2557.apcprd02.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:6108;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: vCcwEIfX4pbkTQZnHncNL64tMUnvJPzmSjedZsLcGxt63ojRlbYP3edaPAdcyTbCsp8rOlgK5Jy0s9red3xqRQAw7fDIMqGwjO2hwWLSTmJgLS1rr8TSVpSEpSWnNCPbhwBqPE9NkvrvdinrQJ7+W1uRFkT9ji7JZyS/+cBYjJWoBktb4OYxR7H+TLgZKVjtn7xbOAnj9fqSHaNoN/U2enI9Ux8DEu969caiYUAmGdqN6w8qpWfab3twxTdypbKB/U0kUmBWHOvaPYL0L7pgZ0i4glChqGOXO5jUyn59UzAXGYAplz7fgRtL28Qr2DZeXRyM2EFmgZcdH8kHggNtSeQxrCd6N5j97Mo0u96fSxCohXZWxqirZ2kDAoyFoHiXw8EmmsdySrSB8L0PjPDZX6KiP3mTpoiAwoxrMzLNFiCr6H9Vd0M53bXFYdtXJg965sDdDa2k2EbiVLohH1u91lESYcODtwlIdE4nLXyiD5Sy8qDqOnkLvQFIML/jO0WsF+BY10YxNowFv0qLmHwvU+UOvLSv5uWWpyxXeQyuizzGSStgAnDls2SW5p9H5YOSL8jksZfGscu0jvaigcDuGtTqH5NGDC8rxTKVg3+chclbsV3c71JQ1ZsM/C7E4g5uRmu0lgxs6G/8a9Ubc3/oKuZxmfwzgQjRk5Xl8YcsyJqMA7++hyJBk6BVyHr1oZWD5P0uxIXWWvYNYUGS155XMHvJ2hsKnpBa5hbYOhYHZ48=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SG2PR02MB4108.apcprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(6486002)(6666004)(1076003)(956004)(36756003)(66946007)(2616005)(66556008)(66476007)(5660300002)(186003)(26005)(83380400001)(316002)(52116002)(38350700002)(508600001)(38100700002)(6506007)(4326008)(2906002)(8936002)(8676002)(86362001)(6512007)(11606007);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?iXQ4bFTYkjCwI+dXVstAsmHh72l+dYfvzV3mZqhsAee/yz1tLe9M9HsHikAj?=
 =?us-ascii?Q?ISF0GMCuNUXeEXav/S4ksBV74hk6JmnhrWx/Z0uraM8vIsCQD1O1XMn4KRrm?=
 =?us-ascii?Q?QyEqDvlALLh4pFZj4+eQzfkaYSTlNlYB6mtKJvvsiFOMl2s1pmbjZwogExkP?=
 =?us-ascii?Q?2I85NAaI58oMl4SfX7i2rZTDMUVRr2cYm/fQBeVTZku+hwI8kaQVTlZTUTlS?=
 =?us-ascii?Q?Ip0fWdS7wVeMq9EvYaEQyOCFFHkUNVS/BtfEG737AzfeZCRnJVC6dKPB/D/w?=
 =?us-ascii?Q?Zam7C+qprCo4otgLHqPDHuznLYbpvFKjM1Iqn61dF+QhQkYyl27WKTmHOYh9?=
 =?us-ascii?Q?8/4Zl69G2W8d7lQjMmNh7ynbcjb4b1Vjpst4VaEv8sYH7DRNn8vsxKi4wfXB?=
 =?us-ascii?Q?CBfVPSLbY7d11w+I4zYxJs7bwVm8/76fzC7ptb/r2zdL3d/IlL41OcTeTT7M?=
 =?us-ascii?Q?a6T6Z4YA+jmo0FtTQHD698mGvYou4gu5YRyjxm0JvitAOJZjUiVrzeTwfMDU?=
 =?us-ascii?Q?/HyXG7RPZSl6YP1UGXA/BrvZoisY+Y9e8fPGk+0BFG45D/zJyIz8d8tvk2ZD?=
 =?us-ascii?Q?07ZVO9thvS9/pPaFj4cnoI9qJLkOR4GBPncp4YerPdfZdRoYyDEL4tyxE6Hj?=
 =?us-ascii?Q?8m/kklwwh17aWllQjmjFIPVFXoqOlUNiMQfVCNdo2dNx/fqC4t3HHBXeX3X9?=
 =?us-ascii?Q?5AOKiwL/2FyeRzzcjV5Nh26hdNSQZT1WDSnoV+ClQEKxsu5fBXWhSOpvr1iH?=
 =?us-ascii?Q?kAaAiak4YsAkI9gU46IWLVTHIzAGMOHD23B7YQwokQnJhFHsgh7QcTnytf5R?=
 =?us-ascii?Q?esy6M2HyOAA44ZTxEhg4nXl/F9HHrqsL5WUkWs8xxp2huOgyog/2Wjxz3cvw?=
 =?us-ascii?Q?3illzdTwQlepu2+WI3ePL4UhA8K402g6sSjbiFIof3rsThpuhu7tPUrfbah1?=
 =?us-ascii?Q?EiRQT7vx9mSbF3nf49K4FyZ7aJEC2SbVanfvvk3RZPw2Jtcoosr7IhoFIQrf?=
 =?us-ascii?Q?SdecGq8seQaywyZb+zoDmY/JDL5N2CqAJwHs/egEKyusbzrBUs2cMQiTAiYu?=
 =?us-ascii?Q?gEUW+v9Jjwt/mCAtWo+/En7Wx32jCmOe3b94xX3HnQb+iadSwaApm/xIEAqk?=
 =?us-ascii?Q?DW+09UyOxM4Sv+1J0LbFa8HuX4a6oF4KaAFrZIPYc+Y+NJ5t7o8mU90VwJ85?=
 =?us-ascii?Q?VZAwYCs+D4Ga/QbnZr2AhTaV4jtJOSUm0pBHb3NLeWoHuGcbr7wauXxCfSey?=
 =?us-ascii?Q?960FPqoSfad4zPGPjf+qXLB77DGwHzNwd5PsPZAon0UiIqvdAxQkAPRo5W3D?=
 =?us-ascii?Q?A834S4j/8VzWWbnVVBUxstQS?=
X-OriginatorOrg: oppo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d439daf3-7223-4f2c-a145-08d97d99e4a3
X-MS-Exchange-CrossTenant-AuthSource: SG2PR02MB4108.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Sep 2021 07:23:37.0851
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f1905eb1-c353-41c5-9516-62b4a54b5ee6
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: vwXT1CwxAoqvCARp3mJEd2X7omgo1g5UU9NwAB1kH4jknjSu3at8z68oty9NwzLAlzz4EQ4bkTqyomAiyENUhA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB2557
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Huang Jianan <huangjianan@oppo.com>

At present, overlayfs provides overlayfs inode to users. Overlayfs
inode provides ovl_aops with noop_direct_IO to avoid open failure
with O_DIRECT. But some compressed filesystems, such as erofs and
squashfs, don't support direct_IO.

Users who use f_mapping->a_ops->direct_IO to check O_DIRECT support,
will read file through this way. This will cause overlayfs to access
a non-existent direct_IO function and cause panic due to null pointer:

Kernel panic - not syncing: CFI failure (target: 0x0)
CPU: 6 PID: 247 Comm: loop0
Call Trace:
 panic+0x188/0x45c
 __cfi_slowpath+0x0/0x254
 __cfi_slowpath+0x200/0x254
 generic_file_read_iter+0x14c/0x150
 vfs_iocb_iter_read+0xac/0x164
 ovl_read_iter+0x13c/0x2fc
 lo_rw_aio+0x2bc/0x458
 loop_queue_work+0x4a4/0xbc0
 kthread_worker_fn+0xf8/0x1d0
 loop_kthread_worker_fn+0x24/0x38
 kthread+0x29c/0x310
 ret_from_fork+0x10/0x30

The filesystem may only support direct_IO for some file types. For
example, erofs supports direct_IO for uncompressed files. So return
-EINVAL when the file doesn't support direct_IO to fix this problem.

Fixes: 5b910bd615ba ("ovl: fix GPF in swapfile_activate of file from overlayfs over xfs")
Signed-off-by: Huang Jianan <huangjianan@oppo.com>
---
change since v2:
 - Return error in ovl_open directly. (Chengguang Xu)

Change since v1:
 - Return error to user rather than fall back to buffered io. (Chengguang Xu)

 fs/overlayfs/file.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index d081faa55e83..a0c99ea35daf 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -157,6 +157,10 @@ static int ovl_open(struct inode *inode, struct file *file)
 	if (IS_ERR(realfile))
 		return PTR_ERR(realfile);
 
+	if ((f->f_flags & O_DIRECT) && (!realfile->f_mapping->a_ops ||
+		!realfile->f_mapping->a_ops->direct_IO))
+		return -EINVAL;
+
 	file->private_data = realfile;
 
 	return 0;
-- 
2.25.1